💰 quantitative finance

Anomaly detection in European cryptocurrency exchange-traded products

This paper introduces and validates three novel binary indicators for detecting intraday market anomalies in European Bitcoin and Ethereum exchange-traded products, demonstrating that these rare events are characterized by distinct microstructure features and can be accurately predicted one minute ahead using machine learning models.

Original authors: Julia Kończal, Rafał Połoczański

Published 2026-08-11

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Julia Kończal, Rafał Połoczański

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the financial world as a giant, bustling marketplace where people trade everything from apples to digital gold. For a long time, the most famous digital coins, like Bitcoin and Ethereum, were traded in a wild, unregulated "backyard" that never closed, where prices could swing wildly at any second. But recently, a new kind of shop opened up inside the official, regulated stock exchanges of Europe. These are called Exchange-Traded Products (ETPs). Think of them as safe, government-watched windows into the chaotic crypto world, where you can buy a slice of Bitcoin or Ethereum during normal business hours, just like buying a share of a company.

To understand what happens inside these windows, scientists use a few key tools. First, they look at "anomalies," which are like sudden, weird glitches in the market—moments when prices drop or jump in ways that don't make sense, similar to a car suddenly swerving without a driver touching the wheel. To spot these, they use a mathematical method called "Extreme Value Theory," which is basically a way of studying the rarest, most extreme events (like the biggest waves in a storm) to set a safety line. They also look at "microstructure," which is the tiny, second-by-second details of how buyers and sellers interact, like counting how many people are shouting to buy or sell at the same time. The big question is: Can we spot these weird glitches before they happen, or are they just random surprises?

This paper is a detective story about four specific crypto products (two tracking Bitcoin and two tracking Ethereum) traded on two European exchanges: Xetra in Germany and Nasdaq Stockholm in Sweden. The authors, Julia Kończal and Rafał Połoczański, spent a year and a half (from January 2024 to December 2025) watching these products tick by tick, using one-minute bars of data. They wanted to find out if these "anomalies" follow any rules or if they are just chaos.

First, they set up a baseline detector using that "Extreme Value Theory" math. They drew a line in the sand: if a price drop is deeper than 95% of all other drops, it's an anomaly. But they didn't stop there. They invented three new, clever ways to spot trouble:

The "Cross-Venue Divergence" Detector: Imagine two twins (the same crypto product) standing in two different rooms (the two exchanges). Usually, they move in sync. If one twin suddenly jumps while the other stays still, that's a divergence anomaly. It suggests a temporary glitch in how the two rooms are talking to each other.
The "No-Recovery" Detector: This looks for a price crash that doesn't bounce back. If a price takes a hard hit and then just limps along for the next ten minutes without recovering, that's a "no-recovery" anomaly. It's like a ball hitting the ground and refusing to bounce.
The "Momentum-Reversal" Detector: This catches a price that has been zooming up happily, only to suddenly slam into the floor. It's like a rollercoaster climbing a hill and then plummeting down right after the peak.

The authors found that these weird events are rare, happening less than 1% of the time (fewer than 1 in 100 minutes). But when they did happen, the market looked very different. During these anomalies, the "effective spread" (the cost to trade) was much higher, and the balance between buyers and sellers was heavily skewed. For example, during a "no-recovery" crash, the trading volume was often 5 times higher than normal, and the cost to trade doubled or tripled.

The most exciting part of the story is the prediction. The authors asked: "Can we guess if the next minute will be an anomaly?" They trained four different computer brains (algorithms like Random Forest and Logistic Regression) to look at the past minute's data and predict the next one. The results were surprisingly good. For the standard "extreme drop" anomalies, the computers could predict the next minute with an accuracy score (AUC-ROC) of up to 0.82. That's a strong signal, suggesting these events aren't entirely random.

However, the paper suggests that the type of data the computers used mattered more than the type of computer. The best predictors weren't the complex details of who was buying or selling (microstructure); instead, the computers relied heavily on volatility (how much the price was shaking) and drawdown (how far the price had fallen from its recent high). It's as if the computers learned that "if the price is shaking violently and has fallen a lot, a crash is likely coming," rather than trying to count the individual people in the crowd.

Interestingly, the "Cross-Venue Divergence" anomalies were the hardest to predict with simple math but were caught well by the more complex "Random Forest" algorithm, suggesting that the relationship between the two exchanges is a bit more mysterious and non-linear. The study also noticed that these weird events happen more often on Fridays and right at the start or end of the trading day, likely because liquidity (the amount of money ready to trade) is lower then.

In the end, the paper suggests that while these European crypto markets are regulated and safer than the wild backyard, they still have their own unique "glitches." These glitches are rare, but they leave behind a clear fingerprint in the data. By watching for specific patterns of shaking prices and lack of recovery, we can actually spot them coming a minute before they happen. It's not a crystal ball that sees the future perfectly, but it's a very good radar for the storm.

Technical Summary: Anomaly Detection in European Cryptocurrency Exchange-Traded Products

Problem Statement
While cryptocurrency markets are characterized by high volatility, fat-tailed return distributions, and fragmented infrastructure, most existing literature focuses on spot markets using daily data. There is a significant gap in understanding the microstructure of regulated European cryptocurrency Exchange-Traded Products (ETPs) at intraday frequencies. Specifically, it remains unclear how anomalous price behavior manifests in these regulated environments, whether such anomalies can be defined using microstructure information, and if they are predictable one bar ahead.

Methodology
The study utilizes one-minute bar data from January 2024 to December 2025 for four Bitcoin and Ethereum ETPs traded on two major European exchanges: Xetra (Germany) and Nasdaq Stockholm (Sweden). The selected instruments are VanEck Bitcoin (VBTC.XE) and Ethereum (VETH.XE) ETPs, and Virtune Bitcoin (VIRBTC.ST) and Ethereum (VIRSETHS.ST) ETPs.

The methodology proceeds in three stages:

Anomaly Definition: The authors establish a baseline anomaly definition using Extreme Value Theory (EVT), specifically the Peaks-over-Threshold (POT) method. This involves fitting a Generalized Pareto Distribution (GPD) to left-tail exceedances to identify extreme negative returns. Building on this, three novel binary anomaly indicators are proposed:
- Cross-Venue Divergence ( $D_{CV}$ ): Identifies temporary pricing discrepancies between ETPs tracking the same asset on different exchanges, measured via rolling OLS residuals.
- No-Recovery ( $D_{NR}$ ): Detects extreme price drops followed by limited recovery (cumulative return over the next 10 bars < 30% of the initial drop).
- Momentum-Reversal ( $D_{MR}$ ): Identifies extreme negative returns that immediately follow a period of positive short-term momentum (5-bar cumulative return).
Microstructure Analysis: The study compares the statistical properties of anomalous bars against normal bars using Mann–Whitney U tests. Key microstructure variables analyzed include effective spreads, relative volume, Amihud illiquidity ratios, Kyle's $\lambda$ , and order flow imbalances (OIB).
Predictive Modeling: An out-of-sample prediction framework is employed to forecast whether the next bar will be anomalous. Four classifiers are tested: Logistic Regression (LR), Random Forest (RF), Extreme Gradient Boosting (XGBoost), and Light Gradient Boosting Machine (LightGBM). Features include 22 price/volatility metrics (e.g., rolling standard deviation, drawdown, RSI) and 12 microstructure metrics. Two feature engineering approaches are compared: session-based (resetting daily) and cumulative (using full historical active bars).

Key Contributions

Market Characterization: The paper provides a comprehensive overview of the European crypto ETP market, noting that while over 200 products exist, trading volume is highly concentrated, with Xetra and Nasdaq Stockholm being the dominant venues.
Novel Anomaly Indicators: The authors introduce three specific binary anomaly definitions ( $D_{CV}$ , $D_{NR}$ , $D_{MR}$ ) tailored to high-frequency ETP data, complementing the standard EVT-based POT approach.
Predictability Evidence: The study demonstrates that all four anomaly types are predictable one bar ahead, challenging the notion that such events are purely random noise in regulated markets.

Results

Statistical Properties: Anomalous bars constitute less than 1% of total valid bars. Statistical analysis reveals that anomaly observations exhibit significantly higher effective spreads, higher liquidity-related ratios (Amihud, Kyle's $\lambda$ ), and more pronounced order-flow imbalances (typically negative, indicating selling pressure) compared to non-anomalous bars.
Overlap and Timing: The four definitions capture distinct types of events. $D_{CV}$ shows minimal overlap (Jaccard index < 0.03) with other definitions, capturing venue-specific divergences. $D_{NR}$ and $D_{MR}$ show moderate overlap. Anomaly rates peak near market open and close, and are generally higher on Fridays.
Prediction Performance: All four classifiers successfully predict anomalies one bar ahead. The Area Under the Curve (AUC–ROC) values range from 0.56 to 0.82.
- The POT definition is the most predictable, with LR and RF achieving AUC–ROC values up to 0.82 for Bitcoin instruments.
- The Cross-Venue Divergence ( $D_{CV}$ ) is best predicted by Random Forest, suggesting non-linear relationships in cross-venue pricing signals.
- The cumulative feature approach (using historical data across sessions) generally outperforms the session-based approach.
Feature Importance: Permutation importance analysis indicates that short-term volatility and drawdown measures are generally more predictive than microstructure variables. For instance, rolling standard deviation and drawdown are top predictors for POT, while RSI and volatility ratios are critical for momentum-reversal anomalies.

Significance and Claims
The paper claims to be the first to examine how anomalous price behavior appears in regulated European cryptocurrency ETP markets and whether it is detectable and predictable using microstructure information. The findings suggest that while these anomalies are rare, they are associated with distinct microstructure conditions (e.g., higher spreads and selling pressure) and contain predictive information. The results imply that recent intraday variables, particularly volatility and drawdown measures, can be used to partially capture the likelihood of anomalous events, offering potential utility for risk management and monitoring systems in regulated crypto markets. The authors remain modest, noting that while prediction is possible, precision remains low due to class imbalance, and the study focuses on detection and one-step-ahead forecasting rather than trading strategies.

More like this