There's a much less nefarious explanation. I'm not saying they didn't manipulate the order book feeds. I work in the regulated trading space. I've written market data decoders. One is in production inside of a bigger trading system I wrote at a customer as I type this.

The less nefarious explanation is simple. You decide how likely it is: there is no mechanism making sure that IP packets sent to all data feed subscribers arrive at the same time. Exchanges of consequence distribute market data via UDP multicast, over physical links that are as identical as possible (think identical lengths of fibre).

Now if you're receiving JSON via Websocket and parsing it using an allocating parser and your NIC driver is in kernel space and you use a GC'd language and if the exchange loops through a list of TCP connections to send a message to them one at a time and there is jitter in packet delivery time in upstream hosts (and other internet weather) and and and ... you simply cannot expect identical order books at the submillisecond timescale.

A fortiori, throw half of that crap away and suppose they were using userspace NICs and no-alloc single threaded C++ that chills entirely in L1 cache. Still consuming TCP over the public internet.

Over the public internet its likely going to be a TCP feed. I would expect OP was capturing that feed and doing the analysis offline. Most firms do this, even with the collocated UDP setups.

After 2 weeks of digging through our code I’m 100% confident it wasn’t our code. Was able to hook up to a total of 3 additional accounts via api, all 3 books matched, and were started at different times.

We wrote support and they told us they would investigate. Never heard back.

Binance is in Malta, a somewhat corrupt tax haven; are you sure it's illegal there?

Malta is in the EU.

This doesn’t guarantee much in itself. A journalist was murdered there for investigating corruption not that long ago.

And the prime minister’s chief of staff was just arrested over that. Just because illegal stuff happens doesn’t mean there aren’t laws against it.

Sure. That's not the point. The point is corruption increases risk of doing business regardless of whether somebody gets caught. People dying because of investigating corruption only makes the point stronger.

OK, so which EU directive are we dealing with here? Which regulator does Binance answer to?

Their local financial regulator. But the point is EU directives force harmonization of laws governing financial exchanges.