Incident replay · what actually happened
Knight Capital
Date
1 August 2012
Loss
$440M
Knight Capital Group, Inc. — 8-K filing (2 Aug 2012)
NYSE Disciplinary Action 2014-04
T
0.0s / 12.0s
pivot @ 4.0s
verifier REFUTES at T = 4.0sactual deploy 09:30:00 ET
Actual reality
no instrumentation- DEPLOYT-7d → 31 Jul
RLP code re-deployed to 7 of 8 SMARS servers; 8th retains 2003-era 'Power Peg' code reusing the same flag bit
- DEPLOY09:30:00 ET
Market opens; orders begin routing through all 8 servers
- SYMPTOM09:30:33 ET
First symptoms — Knight begins sending high-volume parent orders into NYSE quote-stream
- ALARM09:34:00 ET
First alarms — risk desk sees position blowout in 140+ NYSE-listed names
- WIRE09:34–10:15 ET
Knight executes 4M+ orders against 397M shares across 154 stocks; cannot identify 8th-server source for 45 minutes
- LOSS10:15 ET
Total realised loss: $440M. Knight near-bankrupt within 24h, sold for $1.4B 4 months later
Loading counterfactual timeline…
The customer rule that would have caught it
Order-router test-mode flag values must not reach production order-handlers
Three words. $440M.