How to Detect Crypto Volume Anomalies in Real Time (Binance USDT + Coinbase USD)

Most crypto scanners still treat anomalies as fixed thresholds.

That works until you scan a high-liquidity pair and a thin altcoin with the same rule. One floods you with noise, the other misses the move you actually care about.

Volume anomaly detection works at scale only when each symbol is measured against its own baseline. In AnomIQ, we recompute that baseline on rolling anomaly_5m, anomaly_15m, and anomaly_60m windows.

Scope note (as of April 12, 2026): this post covers only Binance pairs quoted in USDT and Coinbase pairs quoted in USD.

You can use this implementation and these filters to separate signal from churn.

The Three Inputs: Notional Volume, Trade Size, Trade Count

Everything starts from 1-minute trade summaries. The anomaly engine rolls those forward in real time.

Important distinction:

• volume answers: how much dollar value traded
• size answers: how much base quantity traded
• count answers: how many prints occurred

Two symbols can print a similar volume anomaly for opposite reasons: a few large prints or many small prints.

Rolling Architecture (5m / 15m / 60m)

The engine keeps a rolling buffer of 1-minute bars and builds higher windows from that stream. It does not wait for fixed candle closes.

1. Ingest 1-minute trade summaries for each symbol.
2. Keep rolling aggregates for 5m, 15m, and 60m.
3. Build current window metrics as closed bars plus the live in-progress bar.
4. Build baselines from historical rolling windows (excluding the active signal window).
5. Compute ratios, z-scores, and derived fields independently for each timeframe.

Baseline sample counts in production are:

• 5m uses 60 historical 5m rolling windows.
• 15m uses 300 historical 15m rolling windows.
• 60m uses 1440 historical 60m rolling windows.

Exact Formulas

Ratio

ratio = (current_value / historical_mean) * 100

Used for:

• total_volume_ratio, buy_volume_ratio, sell_volume_ratio
• total_size_ratio, buy_size_ratio, sell_size_ratio
• total_trades_ratio, buy_trades_ratio, sell_trades_ratio

Z-Score

z = (current_value - historical_mean) / historical_stddev

Used for:

• vol_z, buy_vol_z, sell_vol_z
• trade_z, buy_trade_z, sell_trade_z
• size_z, buy_size_z, sell_size_z

Edge behavior in code:

• if historical stddev is 0 and current value is above mean, z is forced to 10.0
• otherwise it returns 0

Net Taker Imbalance

net_taker_imbalance = ((buy_volume - sell_volume) / total_volume) * 100

Derived concentration and intensity

buy_volume_concentration  = buy_vol_z  - buy_trade_z
sell_volume_concentration = sell_vol_z - sell_trade_z
intensity_z               = vol_z      - trade_z

These deltas show whether the anomaly comes from larger prints, more prints, or both.

Buy vs Sell vs Total Across Timeframes

Each timeframe exposes the same field families, so filter logic is portable:

Path examples:

• anomaly_5m.buy_vol_z
• anomaly_15m.sell_trade_z
• anomaly_60m.size_z

How to Read Volume vs Size vs Count Divergence

Most false positives come from ignoring divergence between volume, size, and trade count.

Pattern A: vol_z > size_z > trade_z

Interpretation:

• Dollar flow is rising faster than base quantity and faster than execution count.
• Notional urgency rises faster than print frequency.

Filter example:

anomaly_5m.vol_z > 3.0
AND anomaly_5m.vol_z > anomaly_5m.size_z
AND anomaly_5m.size_z > anomaly_5m.trade_z

Pattern B: trade_z >> vol_z

Interpretation:

• Many executions, but not proportional dollar flow.
• Typical of fragmented, lower-conviction flow.

Filter example:

anomaly_5m.trade_z > 3.0
AND anomaly_5m.vol_z < 1.5

Pattern C: High buy volume with weak sell confirmation

Interpretation:

• Buy-side pressure is anomalous while sell-side participation is not.

Filter example:

anomaly_5m.buy_vol_z > 2.5
AND anomaly_5m.sell_vol_z < 1.0
AND anomaly_5m.net_taker_imbalance > 20

Production Filter Templates

1) Buy-side anomaly with cross-timeframe confirmation

volume_notional > 500000
AND anomaly_5m.buy_vol_z > 2.5
AND anomaly_15m.buy_vol_z > 1.5
AND anomaly_5m.net_taker_imbalance > 20

2) Notional outruns size (your requested case)

volume_notional > 500000
AND anomaly_5m.vol_z > 2.5
AND anomaly_5m.vol_z > anomaly_5m.size_z
AND anomaly_5m.buy_vol_z > anomaly_5m.buy_size_z

3) Large-print buy concentration

volume_notional > 500000
AND anomaly_5m.buy_vol_z > 2.5
AND anomaly_5m.buy_volume_concentration > 1.5
AND anomaly_5m.net_taker_imbalance > 20

4) Sell-side liquidation pressure

volume_notional > 500000
AND anomaly_5m.sell_vol_z > 2.5
AND anomaly_15m.sell_vol_z > 1.5
AND anomaly_5m.net_taker_imbalance < -20

Practical Notes Before You Deploy Filters

1. Start with a liquidity floor (volume_notional). Without it, thin books will pollute your feed.
2. Use 5m for detection, 15m for confirmation, 60m for regime context.
3. Treat one-bar spikes as weak evidence. Persistence across updates is what matters.
4. Pair raw directional fields (net_taker_imbalance) with z-score fields. One tells direction, the other tells rarity.
5. Tune by market behavior, not by a single coin that looked good in one replay.

FAQ

Which pairs are included in this analysis?

As of April 12, 2026, this article refers only to:

• Binance pairs quoted in USDT
• Coinbase pairs quoted in USD

What does volume_notional mean?

volume_notional is total traded dollar notional since 00:00 UTC for the current day. It is a top-level liquidity gate, not a directional signal.

Is trade size the same as notional volume?

No. In this engine:

• volume is USD notional (qty * price)
• size is base quantity

Those fields diverge during sharp repricing.

Why compute the same metrics on 5m, 15m, and 60m?

Use all three windows to rank conviction. A 5m spike without 15m support often fades.

What does buy_volume_concentration tell me?

It is buy_vol_z - buy_trade_z. High values mean buy-side volume is concentrated in fewer, larger executions rather than many small prints.

Is this fixed-threshold scanning?

No. The engine normalizes each symbol on each timeframe, so one rule can scan liquid majors and thinner pairs.

For baseline-relative logic, seeWhat Is a Z-Score in Crypto Trading and Why Relative Signals Beat Fixed Thresholds. For directional flow context, see Net Taker Imbalance: What It Measures and Why Order Flow Traders Use It.

Open the scanner and test these filters live.