This Is What Happens When An HFT Algo Goes Totally Berserk And Serves Knight Capital With The Bill

Tyler Durden's picture

We all know something went horribly wrong in various NYSE-traded stocks today between 9:30 am and 10:15 am. So wrong in fact that the NYSE had to step in and cancel numerous trades in 6 symbols. However it did not DK millions of other trades in 134 other symbols, the vast majority of which we assume traded errantly due to the market making of Knight Capital (as admitted by the company), which today saw its biggest drop ever since going public on volume about 60 times greater than its average. We also all know that one should buy low and sell high. At least that is what human traders are taught, and that is what they attempt. Because if one consistently does the opposite, one will simply run out of money. Well, the opposite is precisely what the berserk algo in Knight's Market Making group may have done if Nanex, which has done a forensic analysis of one of the trades in question, is correct. In other words, instead of at least attempting to provide liquidity via limit trades, Knight's algorithm acted as a market order... gone horribly wrong. As the third chart below shows what the algo did with furious repetition and steadfast consistency was to buy at the offer, and sell at the bid, in other words buy high and sell low. Over and over and over and over. As Nanex laconically notes, "In the case of EXC, that means losing about 15 cents on every pair of trades. Do that 40 times a second, 2400 times a minute, and you now have a system that's very efficient at burning money." Which also means that by not DK'ing several hundred million prints, the NYSE may have just thrown Knight under the bus, because the market maker is suddenly on the hook for tens if not hundreds of millions in inverse market making profits.

Here we will assume that readers are sufficiently familiar with market structure to know that market makers only participate in the market in order to collect liquidity rebates, i.e., to be the limit on the bid which is hit, or the offer which is lifted. What Knight did was effectively the opposite, and it also collected the opposite of a rebate: i.e., it paid someone else for no reason at all... well technically to withdraw liquidity. However liquidity that led to creation of losses not profits.

Naturally, when the entire logic of trading was perverted courtesy of Knight's busted algo, everything went Bizarro Day, and stocks went higher, because they went higher, and the higher they went, the greater the incentive for the algo to keep pushing the stock higher. This explains not only the volume surge, but also the shocking price moves in some stocks such as China Cord Blood which exploded several hundred percent higher before someone had to finally step in. And what is most notable is that because there were neither fat finger trades, nor busted algos that took out the entire bid or offer stack in one trade, thus triggering circuit breakers, but a slow methodical bleed, there was no reason under the current SEC order cancellation methodology to bail out Knight and its berserk algorithm.

Simply said: today may be the single worst day in Knight's market making history. And sadly, as the NYSE already noted minutes before the market close, the decision to not cancel any more trades is "not subject to appeal."

From Nanex:

What really happened, or how to lose a ton of money, fast.

What follows should strike you as crazy. If it doesn't, read it again, because it is.

The following 3 charts plot non-ISO trades (regular trade condition) reported from NYSE in the stock of Exelon Corporation (symbol EXC). By plotting and connecting only regular trades from NYSE we get a clearer picture of the nature (some might say horror) of this event.

1. EXC One second interval chart. Circles are trades, the blue coloring is the NYSE bid and ask which is mostly covered by gray lines that connect the trades.


2. Zoom of above chart showing about 27 seconds of data. Now the gray lines connecting trades are more clearly visible. NYSE's bid/ask is the blue shaded area (the bid price is the bottom of the shading, and the ask is the top).

3. Zooming in to a 1 millisecond interval chart, we can see one second of data which shows 39 trades.

Note how the trade executions ping pong from bid to ask. As if someone is buying at the offer, then 10 ms later selling at the bid, and so forth. It turns out, the gray shading you see in the first chart of EXC is from this alternating between buying and selling. That's right, almost all these trades alternate between buying at the offer and selling at the bid, which means losing the difference in price. In the case of EXC, that means losing about 15 cents on every pair of trades. Do that 40 times a second, 2400 times a minute, and you now have a system that's very efficient at burning money.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.
Dr Benway's picture

At least someone is looking, unlike in Australia.


Note to ASIC: AFI, ARG, SOL, DJW are all manipulated in a way that is trivial to prove.


Support algo: All trading during the day at bid, yet the bid doesn't move?

Ramping algo: For every trade at bid, a higher bid is posted. This means the buyer is trying to get the worst possible price by raising his bid even as everyone's selling, ie the opposite of normal market behaviour, and the share price rises even though every trade is at bid.

Both of these algos leave a ridiculous paper trail, and are very easy to forensically prove.


But ASIC are accomplices to the criminals and refuse to do anyhting.



Daily Bail's picture

It couldn't happen to a more deserving, more corrupt market maker.

Daily Bail's picture

The only way the story could get better is if we learn that Knight's Algo got hacked from the outside by some hedge fund that was exacting revenge after being raped by NITE for tens of millions thru the years.

Tippoo Sultan's picture

Knight -- you rapacious, Luddite bastards. And this is what living, breathing specialists have been replaced by ?

Aziz's picture

"This is what happens when Snooki takes a lot of cocaine and exposes her vagina in public"

nmewn's picture

Well thanks for that visual, now I need titty bar therapy to erase

GMadScientist's picture

Okay, fine, but put a new diaper on it!

CCanuck's picture

+1000 Best laugh of the day, cleaning another screen and keyboard.


RiverRoad's picture

Why do I have the feeling that somewhere under the full moon tonight a small group of people are popping champagne corks and laughing.........?

dvfco's picture

Daily Bail - How about - maybe you are very close (the Chinese did it). How about, the reason China Cord Blood went up several X was because (the Chinese did it) it was hacked from Guongdong and the greedy hackers were greedier than they should have been. Instead of hacking into Knight and placing trades on say, American and Israeli companies and planting the seed that the smartest Iranian did it, maybe they made a boatload of money, but knew they could double it because they were already long a native stock?

I'm probably crazy, but what I hear is that the Chinese have hacked so far through some firms that that can be done is to have the problem covered with tar paper by the NYSE and others.

Chinese hackers? No way. If that were the case, every time I checked my routers, I'd notice that ports up and down my router were being randomly pinged – all by Chinese IP addresses – or at least 95% from China, and that it happened several hundred times each day.

Oh, shit, wait - that is what I see when I review my router log.

Knight got the whack this time. More coming soon.  Looking back sometime in the future, the flash and this may become known as the straws that broke the camel's back and the timing of PIMCO’s statement might become legendary. How many investors would there be if we all knew we weren't just getting hosed by our brokers, who had the list of all the limit orders in front of them and all other GTC trades, but that the Chinese were hacking these guys? It's more rigged than a Macao casino!!!

We're FUCKED! (Oh yeah - let's give those Chinese kids scholarships to MIT - that should help us. Let's sell Lenovo to them - they probably couldn't learn anything from owning the original IBM computer company. Let's give them all our plans because they can build everything at 1/10th the cost - they won't fuck us in the end.)

Why do deals with the Chinese all seem like the first deal street kids do with drug dealers?

Can you say “Flash Crash” - No , you say – “Frash Crash”. BITCHZ!

We get this for making fun of girl’s world record in swimming.  She went to BALCO!!!


sunaJ's picture

Fortune in browser cookie reads:

Steal from thief, he no can go to police.

DeadFred's picture

That's crazy paranoid, I love it. I also wondered the same. Of course that's not unusual for me. What I thought was that it was the morning's warning to the Fed "We told you no more QE or else and we want to remind you of what 'or else' means"- kind of like the horsehead scene in The Godfather. You know Ben want to print but he doesn't. You know the big players could have taken the market down low enough to justify printing on three or four occasions but they didn't. Blackmail is one of the possible reasons there is no QE candy. Of course it could be functional market forces that are keeping Ben from doing his job but how improbable is that?

RiverRoad's picture

Looks like Hal is alive and well.

dvfco's picture


StandardDeviant's picture

"Never ascribe to malice that which is adequately explained by incompetence." --Napoleon Bonaparte

I have to say, ZH readers take the gold for the shortest interval between event and explanatory conspiracy theory.  Well done, sir!

spine001's picture

Your are way too innocent for this site. If they were hacked do you believe that they would tell the sheeple? NO WAY, it would be hidden like you can't imagine with the complete complicity of the US government.

Otherwise, imagine the panic it'd create worldwide if the NYSE could be affected the way it was by rogue hackers that could be sitting in Iran or China.

This type of hacking could be lot more effective weapon than any neutron bomb that couldn't possibly be used in today's world, thus making them only "capital cost" that doesn't produce anything tangible.

But the only way you'll ever find out is by seeing the USA take NO real action against IRAN or CHINA when it's obvious to all that it should. That will tell you that they have the USA by our neck.

Until next time,


Note: never expect positive proof for sensitive news, you will need to infer them from the actions of the powerfull .0001%


Michael's picture

Amazing, just like the good old Dr Ron Paul I know and love.

Ron Paul on CNBC's Closing Bell, 8/1/12

Michael's picture
Court Demands TSA Explain Why It Is Defying Nude Body Scanner Order

A federal appeals court Wednesday ordered the Transportation Security Administration to explain why it hasn’t complied with the court’s year-old decision demanding the agency hold public hearings concerning the rules and regulations pertaining to the so-called nude body scanners installed in U.S. airport security checkpoints.

The U.S. Circuit Court of Appeals for the District of Columbia Circuit’s brief order came in response to the third request by the Electronic Information Privacy Center for the court to enforce its order.

A year ago, the circuit court, in a lawsuit brought by EPIC, set aside a constitutional challenge trying to stop the government from using intrusive body scanners across U.S. airports. But the decision on July 15, 2011 also ordered TSA “to act promptly” and hold public hearings and publicly adopt rules and regulations about the scanners’ use, which it has not done.

Michael's picture

Awesome Video;

Ron Paul on Fox Business with Melissa Francis 8/1/12

Element's picture


" it-covered-too-much-territory"


Surreal ... just what the fuck does THAT mean?

Are we supposed to understand something to be ever so clarified by this obfuscatory utter gob-shyte?

Or did it, intentionally make this sound like a complete load of mysterious and insane horseshit - on purpose?

Why is that an excuse or convincing rationale?  Is it merely because that's what the hapless moron came up with?

When the revolt comes, the fetid idiot needs to be drowned in a week-old unflushed toilet bowl ... slowly ... water-board style ... with lots of swallowing and gagging.


(and if I flew to the USSA today, I'd have to explain that comment to a pack of TSA and Homeland sickurity cocksuckers, who are looking outside at nothing, ... instead of inside at something ... and pretend they're defending the freedom of speech or some laughable bs)

CompassionateFascist's picture

 The Fed does not need to be audited. It needs to be taken apart brick by brick, and the bricks dumped in the deepest part of the ocean. With a banker attached to each brick.

Vic Vinegar's picture


-who is the power bottom between you and High Plains Drifter?

-I say Ian wins Big Brother - what about you?

-how are you going to take apart the Fed?

-I say this is the best Katy Perry video around - what about you?

Vic Vinegar's picture

Somebody greened you in the meantime.

Call it a conspiracy, but I say the greener has other thoughts about taking apart the Fed.

Rather than sharing them, he/she thinks it is better to green a Katy Perry video.  Same difference? 


DoChenRollingBearing's picture

@ Daily

+ 1  It's almost like we have a Third World country's regulators here!

Meanwhile in Peru...

Born-Again Bankster's picture

Echo that.  And thanks to Tyler for posting that 20 minute video explanation of what happened.  I was 10 minutes into it when I went very long August $5 puts on KCG.  They've tripled already.  That's a lot of monster boxes coming my way. 

GMan_'s picture

I Agree 100%. I can't count how many times NITE kept going against me in my trades. They're f*cking retarded.

Mac1492's picture

knight has been involved in shady market making practices for a long time this link (does not work anymore was saved way back in 2004)..... knight=corrupt 

[ ... Interestingly, a big chunk of Knight's overall stock-trading last month came from one single Pink Sheets tiny-priced stock, CMKM Diamonds Inc. Knight traded an average of about 3.36 billion CMKM shares a day, representing more than 40% of Knight's average daily share volume for the month. ]

Feb. Trading Was Mixed At Knight, Ameritrade 

Friday March 12, 2004 2:14 pm ET

NEW YORK (Dow Jones)--Last month's stock-trading activity mostly slowed from January's pace at online broker Ameritrade Holding Corp. (NasdaqNM:AMTD - News) and at trade- processing firm Knight Trading Group Inc. (NasdaqNM:NITE - News) . But Knight's numbers showed that the firm had stepped up its trading of more-obscure stocks. 

These are companies whose shares trade not on high-profile markets like the New York Stock Exchange (News - Websites) , but on lesser-known venues such as the Pink Sheets and the Over-the-Counter Bulletin Board. Last month, such trading averaged about 6.9 billion shares a day at Knight, a stock and options trading firm in Jersey City, N.J., compared with daily averages of about 3.8 billion shares in January and 769 million shares in February of last year. 

Interestingly, a big chunk of Knight's overall stock-trading last month came from one single Pink Sheets tiny-priced stock, CMKM Diamonds Inc. Knight traded an average of about 3.36 billion CMKM shares a day, representing more than 40% of Knight's average daily share volume for the month. 

CMKM describes itself as "a new company involved in the exploration for diamonds in the Canadian province of Saskatchewan." The company, whose stock trades on the Pink Sheets under the CMKX symbol, trades "at prices in the hundredths of a cent," Knight said. 

According to the Pink Sheets Web site, a whopping 762.36 million shares of CMKM had recently traded Friday. The last sale price shown for the stock was 0.0001. 

Asked why so much of Knight's business last month came from one little-known stock, Knight spokeswoman Margaret Wyrwas said, "the stocks that we trade represent what our clients are buying and selling." She declined to comment further. 

A representative for CMKM said he couldn't account for the stock activity. "I can't tell you why we're having such a huge volume in trading." 

More broadly, Knight's growing OTCBB and Pink Sheets business gave pause to one Wall Street analyst. Daniel Goldberg, who tracks Knight for Bear Stearns, said in a note that such stocks were "low margin" and that he believed "this will exert further downward pressure on (Knight's) revenue capture per share." 

Wyrwas said that Knight viewed its dollar-volume figures as "the most meaningful statistic," more so than revenue capture per share. In February, Knight's average daily dollar volume fell by nearly 18.5% from what Wyrwas said were "January's extraordinary levels," but rose by 91% from a year ago. February's dollar volume was "in line" with the monthly averages seen in the fourth quarter, Wyrwas added. 

Knight's revenue capture per share numbers weren't immediately available. 

Knight shares were recently up 18 cents, or 1.5%, at $12.22. Over the past 52 weeks, the stock has traded as high as $17.27, on Jan. 21, and as low as $3.88 on March 31 of last year. 

Overall at Knight, February's average daily trade volume dropped by 17.8% from January but climbed by 78.9% from February 2003. Daily average share volume rose both from January and year-earlier levels. 

But that increase was largely due to the rise in OTCBB and Pink Sheets trading. Knight's share volume in Nasdaq and in listed stocks fell from January to February. Market performance in February was mixed, with the Dow Jones Industrial Average advancing and the Nasdaq Composite Index losing ground. 

"The market generally considers February to be a weak month, and this February held to that expected pattern," said Knight Chief Executive Thomas Joyce, in a statement. 

(Goldberg said he didn't own Knight shares. Bear Stearns didn't disclose any investment-banking ties to Knight.) 

Ameritrade Adjusts Earnings Expectations 

Separately, Ameritrade raised the bottom end of its earnings expectations for the second fiscal quarter and the entire 2004 fiscal year, which ends in September. 

The Omaha, Neb., firm now expects to earn 16 cents to 19 cents a share in the second quarter ending in March and 56 cents to 79 cents a share for the full 2004 fiscal year. The top end of the projections didn't change, but the bottom end was lifted. Last month, Ameritrade expected earnings per share could fall to as low as 13 cents for the second quarter and to 53 cents for the full fiscal year. 

Ameritrade's February trading activity rose by 97% from year-ago levels, but was down by 22% when compared with January.

Ameritrade's updated earnings projections came a day after news that three of the company's units were fined $10 million by the National Association of Securities Dealers for allegedly extending credit to clients in an improper manner. Ameritrade, which didn't admit or deny wrongdoing, had said that the fine wouldn't affect its earnings because the firm accrued for it in previous periods. 

Ameritrade was recently off 16 cents, or 1.1%, at $14.53. During the last 52 weeks, the shares have risen to as high as $17.67, on Jan. 21, and have dropped to as low as $3.83, on March 12 of last year. -By Gaston F. Ceron, Dow Jones Newswires; 

banksterhater's picture

Burn these Knight bastards at the stake! SHUT DOWN THE CASINOS!

FinkPloyd's picture

By my calculations the bill is around:

2400 times a minute X $.15 X 45 minutes X across 134 symbols


DanP1966's picture

If you wanted to really hurt the US you could hack in or infect one of these and really take down the market. Even better, if you could infect a few you could destroy the entire market.

All you would need is to have some sense of how the other bots would respond to some given set of numbers, trends or actions. That could be figured out fairly simply.

Because everything happens automatically and in seconds, you could do serious harm before the humans could step in.

Even better, because of the circuit breakers, you would want to do a phased attack. Start on a Monday with one set of bots and take the market down 15% then hit with different bots on Thursday or even the following week and take the market down again. You could even do it just in specific sensitive sectors like financials or energy and then pivot to a new sector on the next attack.
Tijuana Donkey Show's picture

Uh, think Iran hitting the US with that, and a power grid attack. The bad news is that the NYSE would reverse the trades, but the grid will still be fucked. India was a little warm-up for the big show. They cut off tech support, and this is what happens. Thank God that the Apple Geniuses are based in America.

DanP1966's picture

I have worked designing and implimenting secure financial systems as a lead architecht and as a project or program manager for 20 years. I've worked at or with FDIC, OCC, the Fed and BAC. Done some smaller consulting with a couple of smaller banks and with some other financial groups. That and I have done work for Homeland Security and the Department of Defense.

One thing I have learned is that no matter how good you think that your security is....someone with time, resources and determination can find a way in. If hackers can get to the plans for the MX Missile they can get to an HFT algo.

AND, just as with any form of terrorism, they only need to get lucky once, you have to be perfect in defence every time.

How many of these HFT's are out there?

What is the probability that at least a few will be vulnerable.

How many would you need to take over to execute a phased attack? Three? Four at most.

If you are the atacker, you do not even need to successfully mess up the trades or stock prices permanently. From the attackers perspective it makes no difference if the NYSE backs out or invalidates trades.

ALL that matters is that the very act of doing it completely undermines the trust in the market such that even the pros will not trade without a serious level of fear. Not to mention, that multiple attacks would see the regulators and congress scream to destroy and outlaw HFT and so take a huge chunk out of profits from some big players.


Acet's picture

Two-thirds of the software in Investment Banks is developed in India by cheap, barelly skillful monkey-coder types (no, the monkey bit has nothing to do with skin color, it's dev-speak for a disorganized coder who is paid peanuts) and is not exactly tested in a thorough, structured way (much less undergo code reviews) so the Chinese would not even need any crazy cyber-hacking operation: good old social-hacking like $50k in cash to pay a disgruntled Indian coder to insert a nice backdoor or time-bomb is all that's needed.

disabledvet's picture

Actually I would argue the exact opposite. This is nothing more than "price discovery in reverse." crushing blow to Knight...they'll probably be out of business by the end of the week along with a big chunk of CNBC. The fact is these clowns have been using technology that only goes to prove "people are lazy." the purpose of using the machine isn't to create an algo of TRADING outcomes but to create an algo of HUMAN RESPONSES to "trading stimuli.". That's why the human looks...AND IS the machine. Not some friggin model! Knight's model was a dinosaur as soon as it was created. So long knight! Amazingly the Government has unleashed The I Phone on the world! The amount of tradable info on this little sucker is beyond imagination. Now I can hack entire industries...mess with their employees and their business...short the stock (don't do that myself) and make a MASSIVE fortune. Of course "all those Americans lose their job" but hey..."doing God's work here!" of course if I'm out 100 billion on my Facebook IPO that's a lot of businesses to take out..probably a State or two as well. No worries tho! Americans are so busy fighting with each other "I'll be sittin in Rio by the time they know what hit 'em." thank God they're people on the other side of that trade to make it all look good. Oh, wait. THAT WAS KNIGHT TRADING! HELLO GOVERNMENT. ARE YOU GOING TO STOP THIS OR WHAT?

DeadFred's picture

And you might even want to do this if the country where you ythe exchanges are housed devalued your trillion dollar bond portfolio by wanton monetization of debt or if it threatened one of your allies with military force. Of course this could be as simple as shark feeding on shark or the most mundane of causes, human stupidity.

disabledvet's picture

anything done with mathematical precision sets off an alarm bell in my book. "to precise to be an accident." says MORE TO COME. my guess would be Europe which has already been clobbered by the worst Central Bank action ever. "gonna make Japan look like a champ" here soon. and if this Knight thing is any example of what awaits...i say "nationalization is imminent."

ACP's picture

It's one thing to DK Bud Fox for 7g's, but for millions over the course of what, a couple seconds?

Take that one straight in the pooper KNIGHT!


AlaricBalth's picture

Knight to Taxpayers: Can you spare a few million? Pay you back next month, promise.
Taxpayers to Knight: Stop going for the easy buck and start producing something with your life. Create, instead of living off the buying and selling of others.

slaughterer's picture

Worst case scenario: $150m loss for KCG.

This is not another MFG.

emersonreturn's picture

please, may it be viral, may it spread through one and another and leave legions of algos feeling the effects of black death and the lice escaping the rats that sorrily infected them.

DanP1966's picture

Does it seem strange to you that a firm that is so heavily into the electronic trading does not list its CIO on the leadership team?

Dixie Rect's picture

Negative, I am a meat popsicle.

Zero Govt's picture

probably running on Microshite software

you get exactly what you deserve running on garbage

as the saying goes, Microshite in, garbage out 

superflyguy's picture

No, MS works just fine. They were probably doing cost savings and hired some of those budget code writers... you know they type, fresh out of school, willing to work for $7/h.