Kraken Watch

Historical layer:robust z-scores (median/MAD, z = 0.6745·(x−median)/MAD) over up to 720 hourly candles per pair from Kraken's public OHLC endpoint; the newest, uncommitted candle is excluded. Flags at |z| ≥ 3.5: price shocks (log returns), volume surges (above-median volume), volatility bursts (relative candle range). Median/MAD is used so the anomalies being hunted cannot poison the baseline that detects them.

Live tape layer:streaming trades over WebSocket v2 (public, browser-direct, no keys). Large prints (robust z ≥ 4 vs a 30-minute window AND ≥ $25k notional), trade bursts (this minute vs the window's per-minute distribution), one-sided flow (5-minute buy share ≥ 85% or ≤ 15%, window must span 3+ minutes). Per-pair cooldowns stop flag flooding.

Book layer (L2, top 25 levels): spread blowouts (robust z ≥ 4 AND ≥ 2× median spread), liquidity drains (resting depth under 40% of its 5-minute median), and a vanishing-liquidity heuristic: a level ≥ $150k appearing ≥ 5 bps off-touch and disappearing untraded within 45s is spoof-SHAPED. Public data cannot prove intent, so it is labeled a heuristic, never an accusation. Level 3 (per-order) data requires authentication on Kraken, so it is deliberately out of scope for this public-data-only build.

Triage:every flag carries a severity (S1-S3, structural book events are always S3), can be labeled a false positive (stored locally, exported in the CSV audit trail), and live flags snapshot the book state at fire time for inspection. Optional webhook alerts are user-supplied and fire from the viewer's own browser.

Provenance: REST OHLC via a small Cloudflare Pages Function proxy (the same architecture as the ADX equities dashboard this methodology is ported from); everything else straight from wss://ws.kraken.com/v2. No account, no API key, nothing stored server-side. Demo, not investment advice.