When a market moves too fast: how a crypto exchange halts trading and recovers
A crypto exchange fences each market's price with a band. An order priced outside it is rejected, a trade that would print outside it halts the market, and an auction reopens it at one price.
A crypto exchange halts a market on purpose when its price moves further or faster than the market's rules allow. Each market has a reference price and a band around it: an order priced outside the band is rejected, and an order that would trade outside it stops the matching and halts the market. Trading then reopens, often through a short auction that finds one price, and the matching engine underneath is built so that neither a halt nor a restart loses or doubles a fill.
Why an exchange stops its own market
A price can move for reasons that have nothing to do with what an asset is worth. A mistyped order, a large order meeting a thin book, or a burst of automated selling can print prices that nobody would accept a minute later, and every chart, stop order and trading bot then reacts to those prints.
A halt buys time. The operator sees what happened, traders can withdraw orders they no longer want, and trading restarts at a price that reflects real interest rather than one stray fill.
In the EU, MiCA builds this into the rules for trading platforms. A platform's operating rules have to "set conditions under which trading of crypto-assets can be suspended" (Article 76(1)(g)), and its trading systems have to ensure orderly trading under conditions of severe market stress and be able to reject orders that exceed pre-determined volume and price thresholds or are clearly erroneous (Article 76(7)(c) and (d)).
The reference price and the band
Every market has a reference price: the price the band is drawn around. It is often the last trade, and it can also be a short average, the price at which the market last reopened, or a price taken from outside markets.
Around it sits a price band, usually a percentage either side. Two kinds are common, and many venues use both:
A static band stays put around a reference that changes rarely, such as the last reopening price. It catches a large jump.
A dynamic band follows the last trade over a short window. It catches a slide made of many small steps, none of which would break a static band on its own.
The width is set per market. A deep, liquid market can live with a narrow band; a small, volatile token needs a wider one, or it would halt all day. In the example used throughout this guide, with illustrative numbers, BTC/USDT has a reference price of 60,000 USDT and a band of 5% either side, from 57,000 to 63,000.
You can see this in Marengo, our exchange: each market has its own price band, set by staff in the backoffice, and a sharp price move halts the market.
What trips a halt
A band is checked at two moments: when an order arrives, and while it is being matched.
A fat-finger order. A trader means to sell 0.5 BTC at 60,000 and types 6,000. Checked on arrival, the price is far outside the band, so the order is rejected before it reaches the order book. The market never sees it, and nothing halts.
A large order meets a thin book. A big market order to sell arrives when few buyers are bidding. It fills against bids at 59,950, 59,400, 58,600 and 57,300, each lower than the last. The next bid is at 56,400, outside the band, so the engine stops before that trade and halts the market.
A sharp move over time. A dynamic band catches a price that slides further than allowed within a few minutes, even when no single trade jumps far.
What happens to the unfilled rest of the order in the second case is set by the rules: it is commonly cancelled, and on some venues kept for the reopening. Either way, nobody receives a fill at a price outside the band. A thin book is the condition behind most of these moves, and it is why liquidity and slippage matter as much as the band itself.
Halts also start by hand. Staff halt a market when a token's own network stops producing blocks, deposits are stuck or news is pending. In the EU, the national regulator can also suspend, or require the platform to suspend, trading of a crypto-asset for up to 30 consecutive working days where it has reasonable grounds to suspect MiCA has been infringed (Article 94(1)(n)).
What happens to orders during a halt
A halted market is frozen, not emptied. The details are the operator's published rules, but most venues work along these lines:
Matching stops. No trades print, so the last price and the chart stand still.
Resting orders stay on the book, at their price and place in the queue, unless the rules cancel them.
Cancels are accepted. Letting traders withdraw is part of the point.
New orders are refused, or kept for the reopening. Market orders are often refused, since there is no price to fill them against.
Stop orders wait. A stop order triggers on a traded price, and nothing trades during a halt.
Everyone is told. The market data feed and the API mark the market as halted, so apps, charts and market makers' systems all show the same status.
How trading reopens
Reopening has two questions: when, and how. When is set in the rules, either after a fixed pause or once staff have understood the cause. With Paynoramic's exchange software, that decision belongs to the licensed operator: Paynoramic builds and hands over the software and runs no market.
How matters as much. Simply switching continuous matching back on lets the first order set the price, wherever it lands. Many exchanges reopen with a short call auction instead:
Collect. Orders arrive and rest, and nothing trades. The book can cross, with buyers bidding above sellers.
Find the price. For each possible price, the engine adds up the buying at or above it and the selling at or below it. The price where the most would trade becomes the reopening price, with tie-break rules for equal amounts.
Uncross. Every order that crosses that price fills at that one price, with price-time priority deciding who fills where an order is only partly matched.
Resume. Continuous trading starts from the reopening price, and the band is recentred on it.
In the example, the auction gathers buy orders of 2.0 BTC at 59,200, 1.5 at 59,000, 3.0 at 58,800 and 2.5 at 58,500, and sell orders of 1.0 at 58,400, 2.0 at 58,600, 2.5 at 58,800 and 3.0 at 59,100. At 58,800, 6.5 BTC of buying meets 5.5 of selling, more than at any other price, so the market reopens at 58,800 with 5.5 BTC traded. A buy of 1.0 at 58,800, the buy at 58,500 and the sell at 59,100 stay on the book, and the new band runs from 55,860 to 61,740.
Underneath: one log, snapshots and replay
The guide to what happens when you press Buy explains how one numbered log, snapshots and replay keep each order processed exactly once. A halt adds one requirement: the market's state has to survive a restart as surely as the book does.
A halt is an input like any other. A staff halt is a command written to the same numbered log as orders and cancels. A band halt follows from the order that caused it, so replaying that order halts the market again.
A snapshot holds the whole state. The book, each market's status (trading, halted or in an auction), its reference price and band, and the number of the last input included.
A restart loads and replays. The engine loads the latest snapshot and replays the log from the next number. If the snapshot ends at #1042 and the engine restarts after #1044, replaying #1043 halts the market again, so it comes back halted rather than trading.
Fills are not doubled. Replay produces again the fills that were already sent out. Each fill carries the number of the input that caused it, so the ledger and every other consumer ignore one they have already booked.
MiCA asks for the same outcome in its own words: a trading platform's systems are to be subject to effective business continuity arrangements to ensure the continuity of their services if there is any failure of the trading system (Article 76(7)(f)).
Marengo, our exchange, works this way: its deterministic matching engine processes each order exactly once on Kafka and recovers from snapshots by replaying its log, and each service writes its change and its event in one transaction, with every consumer ignoring duplicates.
A halt is not surveillance
A halt reacts to a price; it does not decide whether anyone did wrong. MiCA treats that as a separate job: trading systems have to be able to prevent or detect market abuse (Article 76(7)(g)), and anyone professionally arranging or executing transactions in crypto-assets needs effective arrangements, systems and procedures to prevent and detect it, reporting any reasonable suspicion to the regulator without delay (Article 92(1)).
In practice the two meet after a halt. Surveillance looks at the orders that led to it and asks whether it was a genuine mistake, a thin market or an attempt to move the price. The rest of a platform's obligations are in the MiCA checklist.
Frequently asked questions
Is a trading halt the same as an exchange outage? No. A halt is a deliberate state of one market under published rules, while other markets keep trading and orders can still be cancelled. An outage is a failure; a well-built engine recovers from its snapshot and log, and each market comes back in the state it was in.
Do open orders survive a halt? Usually. Resting limit orders stay on the book at their price and place in the queue unless the rules cancel them, and their owners can cancel them during the halt.
Why halt rather than just reject the order that would trade outside the band? Some venues do exactly that: they cancel the rest of the order and keep trading. A halt gives the book time to refill and other traders time to react, and which one a market uses is a choice written into its rules.
See it working
A band and a halt are easiest to picture on a live order book. Open Marengo at marengo.paynoramic.com, switch to Pro and watch a market's book and trades tape, or read about the white-label crypto exchange to see what is built and handed over.
