What Happened to Knight Capital? $440 Million Lost in 45 Minutes, No Hacker

What happened to Knight Capital?

On August 1, 2012, a trading router at Knight Capital ran old, broken code on one of its eight servers. In about 45 minutes it sent millions of orders into the US stock market and built up billions of dollars in positions nobody wanted. Knight first reported a pre-tax loss of about $440 million; the SEC later put it at more than $460 million. No hacker was involved.

• The cause was a deploy. New code went to seven of eight servers. The eighth still had old code called "Power Peg," and a reused flag switched it on.
• There were warnings. Before the market opened, Knight's systems sent 97 automated emails that named the error. The SEC found staff "generally did not review them."
• Nothing stopped it. The SEC found Knight had no procedures to halt the router when it misbehaved, and no firm-wide capital limit that blocked new orders.
• The bill. A $400 million rescue investment five days later, and a $12 million SEC penalty in 2013.

Video: “$440 Million Gone in 45 Minutes. No Hacker.” by Dooza on YouTube (@thedooza), published November 3, 2026. Narrated by an AI voice with AI illustrations; sources below. Watch on YouTube.

What is the Knight Capital timeline?

All dates come from the SEC order unless noted.

Date	What happened	Source
2003	Knight stops using its "Power Peg" function. The code stays on the servers.	SEC order
2005	Knight moves the share-counting part of Power Peg. It does not retest Power Peg afterwards.	SEC order
July 27, 2012	Knight starts deploying new code for the NYSE Retail Liquidity Program, server by server.	SEC order
Aug 1, 2012, about 8:01 a.m. ET	Automated emails start flagging "Power Peg disabled." 97 go out before the 9:30 a.m. open.	SEC order
Aug 1, 2012, from the open	For about 45 minutes the router sends millions of orders while staff hunt for the cause.	SEC order
Aug 2, 2012	Knight reports a realized pre-tax loss of about $440 million.	Knight press release (8-K)
Aug 6, 2012	Knight sells $400 million of preferred stock to a group of investors.	Knight 8-K
July 1, 2013	Knight's parent and GETCO combine to form KCG Holdings.	SEC order
Oct 16, 2013	Knight agrees to pay $12 million to settle SEC charges.	SEC press release

Why did it happen?

The SEC order lays out a chain of small failures. None of them was a hack.

1. Old code was left switched on

Knight's router, called SMARS, still held code for a function called "Power Peg." Knight stopped using it in 2003, but the SEC says it "remained present and callable." In 2005 Knight moved the part that counted filled shares, and it did not retest Power Peg. So if Power Peg ever ran again, it would not know when to stop.

2. A flag got a new job

The new code reused a flag that used to turn on Power Peg. The plan was that the flag would now turn on the new feature instead.

3. One of eight servers was missed

The SEC says one technician "did not copy the new code to one of the eight SMARS computer servers." No second person reviewed the deploy, and Knight "had no written procedures that required such a review." On August 1, the seven updated servers worked. Orders that reached the eighth server woke up Power Peg. It kept sending child orders for each customer order, with no regard for how many shares had already been bought.

4. The warnings were ignored

From about 8:01 a.m. ET, an internal system sent emails, known as "BNET rejects," that named an error: "Power Peg disabled." It sent 97 of them before the open. The SEC says Knight did not design them as alerts and staff "generally did not review them." They were not acted on before the open.

5. There was no way to stop it

This is the part that turned a bug into a disaster. The SEC found Knight "did not have procedures in place to halt SMARS’s operations in response to its own aberrant activity." Its main risk tool "relied entirely on human monitoring" and did not block orders when limits were passed. Knight also had no firm-wide capital limit wired to stop new orders. Then, trying to fix things live, staff removed the new code from the seven good servers. The SEC says "This action worsened the problem," because those servers started running Power Peg too.

What did it cost Knight Capital?

• The trades. To fill 212 customer orders, the router sent millions of orders. That produced 4 million executions in 154 stocks, for more than 397 million shares, in about 45 minutes.
• The positions. Knight ended up with a net long position of about $3.5 billion in 80 stocks and a net short position of about $3.15 billion in 74 stocks.
• The loss. On August 2, Knight said it had traded out of the position, with a "realized pre-tax loss of approximately $440 million." The SEC order later said Knight "lost more than $460 million." The short video uses the first number.
• The rescue. On August 6, 2012, Knight sold preferred stock to a group of investors for $400 million in cash. That stock equaled about 73% of the common stock on an as-converted basis. Knight's Finance and Audit Committee said waiting for a shareholder vote "would seriously jeopardize the financial viability of the Company." Details are in the 8-K.
• The fine. In October 2013 Knight agreed to pay $12 million. The SEC called it its first enforcement action under the market access rule, per its press release.

The damage reached other traders too. For 37 stocks, the price moved by more than 10% and Knight's trades were more than half the volume, according to the SEC order.

What is the lesson for businesses using software or AI agents?

This part is our own takeaway, not the SEC's. Knight's software did exactly what its code told it to do. It did it very fast, with real money, and nobody could stop it in time. Any business that lets software or AI agents act for it faces a smaller version of the same risk.

The SEC's Daniel Hawke put the question well. Firms must ask "what would happen if the component malfunctions and what safety nets are in place to limit the harm it could cause." He added that "Knight Capital’s failure to ask these questions had catastrophic consequences," in the SEC press release.

For a small business, three safety nets cover most of it:

1. A human approval before anything you cannot undo. Sending an email, paying an invoice, placing an order. Knight had no second person checking its deploy. Make the agent ask first.
2. A hard spending cap. Knight's limits did not block new orders. A cap that actually stops spending turns a runaway into a small bill.
3. A way to stop it, and a reason to look. You need to see what the agent is doing and be able to halt it. Warnings that nobody reads, like Knight's 97 emails, do not count.

Where does Dooza fit?

Dooza Crew gives a small business AI employees, each with its own computer and a real browser. You watch every step live in chat, and before an agent clicks Send or Pay, it asks you: Approve, Edit or Reject. Each account has a hard cap on AI spend. $5 to start.

Get the Dooza Crew app