45 minutes. More than $460 million lost.

212 customer orders went in. Millions of unintended orders came out.

On August 1, 2012, an automated order router at Knight Capital malfunctioned during the opening of the US stock market. The firm traded more than 397 million shares in roughly 45 minutes and ultimately lost more than $460 million. The SEC later documented the incident in its enforcement findings. SEC announcement, October 16, 2013.

The numbers make the story memorable. The detail behind them is even stranger: seven servers received an update. An eighth did not.

The server that stayed behind

Knight was preparing for the New York Stock Exchange's Retail Liquidity Program. Its new software reused a flag previously associated with an old function called Power Peg.

That old function had been discontinued but remained in the system. During the rollout, one of eight servers missed the new code. Orders carrying the reused flag reached that server and activated the old function. SEC order, paragraphs 12–16.

Imagine an instruction arriving at eight desks. Seven read it using today's instructions. One interprets it using a procedure everyone thought had been retired. The incoming message looks ordinary; its meaning depends on where it lands.

Why it kept trading

An order router can split a customer's request into smaller orders sent to trading venues. The outdated function kept sending those smaller orders without accounting correctly for the executions already received. SEC order, paragraphs 14–16.

An instruction to trade a specified quantity had become a process that continued beyond that quantity.

The detail before the opening bell

Before the market opened, an internal system generated 97 emails referencing the router and identifying an error. They were not designed as formal system alerts, and Knight did not act on them that morning. SEC announcement.

Read that sequence again: an update, an overlooked server, an old function, and messages arriving before the opening bell.

In isolation, each sounds like a detail in an engineering meeting. Together, they became a market event.

The 45 minutes describe the period of runaway trading; the loss was the eventual financial consequence of the unwanted positions. That distinction matters when we retell the headline.

Which part surprises you more: that obsolete code was still reachable, or that the error messages arrived before trading began?

References

• SEC — SEC Charges Knight Capital With Violations of Market Access Rule, October 16, 2013. Supports the incident date, trading window, share volume, eventual loss, and 97 premarket emails.
• SEC — In the Matter of Knight Capital Americas LLC, Release No. 70694, October 16, 2013. Paragraphs 12–19 describe Power Peg, the reused flag, the missed server update, repeated orders, and email messages. The historical account above paraphrases these findings; the eight-desks analogy is our explanation.