At 2:45 in the afternoon on May 6, 2010, the American stock market was already having a bad day, and then it briefly stopped existing.
The bad day came first, and it matters. Greece was sliding toward a debt crisis, television screens were full of protests in Athens, and by mid afternoon the Dow Jones Industrial Average was down more than 300 points. Volatility was up. Liquidity, the market's word for how much buying and selling is actually standing there waiting, was thinning out. None of that is unusual. Markets have bad days the way airports have delays. What happened next had no precedent at all.
At 2:42 p.m. the Dow was down a bit over 300 points. At 2:47 p.m. it was down 998.5 points, roughly 9 percent, the largest intraday collapse in its history to that moment. Somewhere in those five minutes, shares of Accenture, a consulting giant whose stock had been a boring blue chip all morning, changed hands for one cent apiece. Eight major companies in the S&P 500 traded at a penny. Shares of Sotheby's, the auction house, printed at more than $100,000 each, as if every painting in the building came free with the stock. Procter & Gamble, maker of Tide and Pampers and about as volatile as a fence post, fell nearly 37 percent, from about $60 to $39.37, in roughly three and a half minutes. About a trillion dollars of market value, the accumulated retirement money of a nation, had evaporated.
And then, inside the same half hour, it mostly came back.
To understand how, you have to go to Chicago, and you have to rewind thirteen minutes, to 2:32 p.m., when a computer did exactly what it had been told to do.
The E-mini S&P 500 is a futures contract traded on the Chicago Mercantile Exchange. It is, in effect, a bet on the level of the S&P 500 index, and because it is cheap to trade and open nearly around the clock, it is where big institutions go to hedge. If you run a mutual fund with a large stock portfolio and the world looks frightening, you can sell E-minis instead of selling the stocks themselves. On May 6, against a backdrop the regulators would later describe as unusually high volatility and thinning liquidity, a large fundamental trader, a mutual fund complex later identified in reporting as Waddell & Reed, decided to hedge. It initiated a sell program: 75,000 E-mini contracts, worth approximately $4.1 billion.
The size was not the scandal. Institutions hedge in size every day, and CME would later point out, correctly and loudly, that 75,000 contracts were about 1.3 percent of that day's total E-mini volume. The scandal was the recipe. The fund handed the sale to an execution algorithm with a single instruction: sell at a rate equal to 9 percent of the trading volume over the previous minute. Full stop. In the dry language of the joint report the SEC and CFTC issued five months later, the algorithm was set to target that rate "without regard to price or time."
Sit with that phrase, because it is the whole catastrophe in eight words. The algorithm did not know what the contracts were worth. It did not know whether the market was rising or falling. It did not have a deadline it was trying to beat or a floor below which it should stop. It had one sense organ, volume, and one rule, be 9 percent of it. Earlier that same year, the fund had executed a sale of similar size over more than five hours, the way you might lower something heavy down a long staircase. On May 6, in a market already wobbling, the algorithm finished in about twenty minutes. It did not lower the weight. It let go of the rope and then, as we will see, kept letting go faster, because the rope going down was itself volume.
The first buyers of the flood were high-frequency trading firms. High-frequency traders are intermediaries, the market's relay runners. Their business is to buy from whoever is selling and sell to whoever is buying, holding any given position for seconds, sometimes less, and skimming the sliver of difference. In normal weather this is a genuine service: there is always someone standing there to take the other side of your trade. The catch is that relay runners are not warehouses. They do not accumulate. They pass.
So the contracts began to pass. The high-frequency firms bought from the sell algorithm and sold to each other, each firm flattening its position onto the next, the same positions cycling through the same hands at machine speed. The joint report gave this phenomenon the name it deserves: a "hot-potato volume effect." Between 2:45:13 and 2:45:27 p.m., fourteen seconds, high-frequency traders traded over 27,000 contracts, roughly 49 percent of all the volume in the market, while increasing their net position by about 200 contracts. Read that again. Half the trading in the most important futures market on earth, for fourteen seconds, was the same small pile of contracts being frantically handed around a circle of machines, none of which wanted them.
And here the two systems coupled into a death spiral, because the sell algorithm's one sense organ was volume. The hot potato made volume explode. The algorithm read the explosion as capacity: the market is trading furiously, so it can absorb 9 percent of furiously. It accelerated its selling into the decline. The combined pressure drove the E-mini down about 3 percent in four minutes, from 2:41 to 2:44, which frightened more intermediaries into passing faster, which made more volume, which made the algorithm sell faster. Nobody in this loop was malfunctioning. Every component was executing its instructions. The composition was the bug.
Futures do not fall alone. Arbitrageurs weld the E-mini to the stock market: when the future gets cheaper than the basket of stocks it tracks, they buy the future and sell the stocks until the prices agree. So the welding carried the fire across. The SPY, the exchange-traded fund that tracks the S&P 500, fell in lockstep. And in the stock market itself, the machines that normally stand ready to buy and sell looked at the chaos and did the thing their risk rules told them to do. They left.
This is the moment the event turns from a plunge into a hallucination. Modern markets are required to post quotes, bids to buy and offers to sell, so firms post what are called stub quotes: placeholder prices, a bid of one cent, an offer of $99,999.99, numbers chosen precisely because they are absurd and will never trade. They are the financial equivalent of writing "a billion dollars" on a form you expect no one to read. On May 6, in stock after stock, the real quotes vanished as market makers withdrew, and the stubs were what remained. Sell orders arriving into an empty book executed against the placeholder. That is how Accenture prints at a penny. That is how Sotheby's prints at six figures. The prices were not wrong in the sense of being miscalculated. They were faithfully executed, against quotes that were never meant to be real, in a market whose depth had turned out to be a fair weather phenomenon.
Procter & Gamble fell nearly 37 percent and then, within minutes, climbed back, because Procter & Gamble had not actually done anything. No factory burned. No product was recalled. Nothing about the value of Tide changed between 2:44 and 2:50. What changed was that the system for agreeing on a price for Tide had temporarily disintegrated, and a disintegrating price system will print any number at all, including a penny and a hundred thousand dollars, with a straight face.
Then, at 2:45:28 p.m., the most effective intervention of the day took place. It lasted five seconds, and it consisted of nothing.
The CME has a mechanism called Stop Logic. When prices move too violently, it pauses trading in the contract for five seconds to prevent a cascade. At 2:45:28 it fired. The E-mini froze. And in that tiny silence, the joint report found, sell-side pressure partly drained away and buy-side interest crept back. Trading resumed at 2:45:33. Prices stabilized. The E-mini began to recover, and the stocks followed it up the way they had followed it down. The Dow printed its low, 998.5 points down, at about 2:47, and then climbed; by 3:07 p.m. it had regained most of the 600 points it had lost in the plunge, and by 3:00 p.m. the regulators found that most stocks had already reverted to prices reflecting something like consensus reality. The whole event, from the start of the sell program to a functioning market, took about thirty-six minutes. The Dow closed the day down about 3 percent. A trillion dollars had gone missing and been found again between lunch and the closing bell, and not one fact about the underlying companies had changed in the interval.
That evening, the exchanges and FINRA did something that tells you how far outside the map the afternoon had wandered. They agreed to cancel trades. Between 2:40 and 3:00 p.m., over 20,000 trades in more than 300 securities had executed at prices more than 60 percent away from where those securities had traded at 2:40. Those trades were broken, voided, as if they had never happened. The 60 percent line was invented on the spot, which meant that an investor who sold at 59 percent below fair value had made a real trade, and one who sold at 61 percent below had made an imaginary one. It was rough justice, administered overnight, and everyone involved knew it. The rulebook for the next crash, the clearly erroneous trade rules and the single-stock circuit breakers that arrived within weeks and later grew into the limit up, limit down system, was written precisely so that the line would exist before it was needed. Notice which part of the system got reformed first. Not the selling. Not the algorithms. The pause. The one mechanism that had worked on the day was the five seconds of nobody trading, and the regulators' main achievement afterward was to install more pauses, in more places, with the triggers written down in advance.
The investigation took five months and produced a 104 page joint report, and even its account of the trigger was argued about from the day it landed, with the CME publicly insisting the sell program was ordinary hedging and other analysts picking at the details. But the argument that consumed the next five years was not about the algorithm. It was about a man in a house in Hounslow.
On April 21, 2015, nearly five years after the crash, the Department of Justice announced 22 criminal counts against Navinder Singh Sarao, a British trader who worked from his parents' home in west London with commercially available trading software he had paid programmers to modify. His technique was spoofing. He would place enormous sell orders just above the market, orders he never intended to let execute, thousands of contracts of pure theater designed to make the book look heavy with sellers and push prices down, trade against the push, and cancel the theater before it could be filled. On May 6, 2010, prosecutors alleged, he had run this play with about $200 million in spoof orders, replaced or modified some 19,000 times, and the CFTC said he was at least significantly responsible for the order imbalances that preceded the crash. In November 2016 he pleaded guilty to one count of spoofing and one count of wire fraud. The spoofing was real. He admitted it. He had done it for years, and he made millions doing it.
Now the part that has to be said carefully, because it is the part everyone gets wrong at parties. Sarao was charged, and his contribution was alleged, and then the causation claim largely fell apart under examination. The joint report of 2010, written by investigators with the full data and five months to study it, never mentions him. In January 2016, three academics, Eric Aldrich, Joseph Grundfest, and Gregory Laughlin, published a deconstruction of the event and concluded that it was highly unlikely Sarao's spoofing orders could have caused the flash crash, and that the crash was waiting to happen in a market whose liquidity was already thinning, spoofing or no spoofing. A government expert, reviewing the same theory, declined to endorse it. When Sarao was finally sentenced in January 2020, prosecutors stressed his cooperation and his lack of ordinary greed as a motive, and the judge sent him home: one year of home confinement, no prison. A real criminal, convicted of a real fraud, who made a poor answer to the question the public actually wanted answered, which was: whose fault was the day the market fell off a cliff? The honest verdict on that question is that the market did it to itself, and that a system that can be crashed by one hedging algorithm and a hall of mirrors did not need a villain. It needed an engineer.
So here is the lesson, and it generalizes far beyond stock exchanges, which is why it belongs in this studio's notebook.
Liquidity is a fair weather property. All morning on May 6, the screens showed a deep, liquid market: tight spreads, fat order books, a trillion dollar machine humming with apparent capacity. Almost none of that depth was a commitment. It was a posture, maintained by participants who were free to leave, and who left, rationally, individually, correctly by their own rules, at the exact moment their presence was the entire point. A bid that evaporates when you reach for it is not a bid. It is a claim about a bid. And the distance between the claim and the fact is where the trillion dollars went.
Every engineer who builds a coupled system should recognize the anatomy, because it is not a finance anatomy, it is a systems anatomy. A controller fed on a metric the system itself can manufacture: the sell algorithm read volume as capacity while the loop it was inside was manufacturing volume, the same category error as mistaking activity for output, or a green dashboard for a healthy service. Counterparties assumed to be load bearing who are in fact load avoiding: the intermediaries would carry any amount of risk for three seconds and none at all for thirty. Placeholders that become real under stress: the stub quotes, the joke prices, sat in the book for years as decoration and executed as fact the one time the real quotes stepped away, the way a default value in a config file is a joke until the day it ships to production. And threading through all of it, a system with interlocks everywhere except where it mattered. Exchanges had pauses. Contracts had pauses. What nothing had was a pause on the composition: no mechanism anywhere whose job was to notice that the whole machine, every part working as designed, was producing an outcome no one had designed.
The fences are boring, which is how you know they are the fences. If a controller consumes a metric, ask who can inflate the metric, and assume they will, innocently or otherwise. If your design depends on a counterparty absorbing shock, read their exit conditions before you count their capacity. If a placeholder value exists anywhere in the system, treat it as a value, because on the worst day of the system's life it will be executed as one. And build the circuit breaker for the composition, the five second pause that belongs to the whole and not the parts, and write down its trigger while everyone is calm. On May 6, 2010, the United States equity market, the deepest pool of capital ever assembled, fell 9 percent in minutes on no news, and the thing that saved it was not a buyer, a bailout, or a hero.
The most valuable trade of the entire day was five seconds long, it was placed by a rule in Chicago, and it consisted of nobody trading at all.
Sources, for the record: SEC and CFTC, "Findings Regarding the Market Events of May 6, 2010" (September 30, 2010), for the 75,000 contracts, the $4.1 billion figure, the 9 percent execution rate "without regard to price or time," the hot-potato volume figures, the five-second Stop Logic pause at 2:45:28 p.m., the 3:00 p.m. reversion, and the more than 20,000 broken trades across more than 300 securities; CME Group's public response to the joint report (October 2010) for the bona fide hedging characterization and the 1.3 percent of daily volume figure; the SEC's congressional testimony and contemporaneous reporting for the Dow's 998.5 point intraday decline, the Accenture penny prints, the Sotheby's prints above $100,000, and Procter & Gamble's fall to $39.37; the Department of Justice's Sarao charges (April 21, 2015) and plea release (November 9, 2016) and CFTC enforcement releases for the spoofing allegations, the $200 million in orders modified 19,000 times, and the "significantly responsible" wording; Aldrich, Grundfest, and Laughlin, "The Flash Crash: A New Deconstruction" (January 2016), for the conclusion that Sarao's spoofing was highly unlikely to have caused the crash; the Associated Press (January 28, 2020) for the sentence of one year of home confinement.