← Incident Index
CivilizationalFinancial Services·August 1, 2012Draft

Knight Capital Group: Knight Capital loses $440M in 45 minutes from incomplete software deployment

A manual software deployment to NYSE's Retail Liquidity Program (RLP) servers updated 7 of 8 production servers; the 8th still ran legacy code that reactivated a dormant test routine ("Power Peg") which placed millions of unintended orders.

Velocity Governance perspective· Sentinel-10 overlap: 2 of 4

2 of the 4 practices that failed in this incident are part of the Sentinel-10 — the engineering protocols Concordance flags as most degraded under AI-accelerated development.

This incident pre-dates today's AI-velocity surge. The thesis is that the same practices that failed here will fail faster under AI velocity if not actively governed. Read the Velocity Governance thesis →

Impact

$440M
Economic impact
0.75h
Downtime
SEC enforcement action 70694
Regulatory action

Knight Capital Group lost $440M in 45 minutes — more than the company's entire previous-year profit. Forced sale of the firm to Getco within months. The canonical case study in deployment-process failure.

Root cause (from published RCA)

A new software release (RLPRE) was deployed to seven of eight production servers manually. The eighth server still contained code from years earlier that reactivated a dormant test function called Power Peg when a specific control flag was set. The new code repurposed that flag for a different purpose. When the release went live, the eighth server interpreted the new flag value as the trigger for Power Peg, which began placing unintended orders at maximum volume.

Concordance protocols that map to this root cause

Click any protocol to see every other indexed incident where it failed.

Protocol 5.4Release Approval· Releasesee all incidents →
Release approval: deployment was performed manually with no automated verification that all production servers were on the same code version.
Protocol 5.7Rollback Capability· ReleaseSENTINELsee all incidents →
Rollback capability: when the runaway orders began, no rollback path existed that could halt them within minutes.
Protocol 5.8Feature Flagging· ReleaseSENTINELsee all incidents →
Feature flagging: a dormant test function was activated by a repurposed flag — clean feature-flag lifecycle would have removed dead code paths.
Protocol 6.1Incident Response· Operationssee all incidents →
Incident response: 45 minutes elapsed between deployment and intervention; no automated kill-switch existed for runaway algorithmic trading.

Primary sources

SEC Order Instituting Proceedings — Knight Capital Americas LLC, File No. 3-15570
US SEC · October 16, 2013
Analysis of the Knight Capital incident
Andrew "bunnie" Huang · October 22, 2013

Related incidents

Other incidents that failed at least one of the same protocols.

CrowdStrikeJul 2024
Falcon sensor channel-file update crashes 8.5M Windows hosts
FastlyJun 2021
Single customer config change triggers global Fastly CDN outage
CodecovApr 2021
Codecov bash-uploader supply-chain compromise exfiltrates customer sec…
#deployment-failure#dead-code#partial-rollout#algorithmic-trading#sec-action
Check your repo against these protocols.
Concordance scores any public GitHub repo against all 50 engineering protocols in 60 seconds. No signup, no install.
Run a free scan →
Concordance Incident Index entry · CC BY 4.0 · Methodology · Errata: hello@concordancelabs.com