Four years, one curriculum, no shortcuts.

Opens with FTX and its affiliate Alameda Research, November 2022. The failure was off the chain, a hole between customer balances and what remained that Bankman-Fried himself put at as much as 8 billion dollars, but the warning was on it. Source: nansen.ai

1. G101-01 What the chain records, and the run FTX could not hide 30 min
2. G101-02 Schema literacy: accounts, transactions, logs, and events 30 min
3. G101-03 Aggregating with SQL and Dune 30 min
4. G101-04 What a query cannot tell you 30 min

Opens with The Bitfinex hack of August 2016 and its unwinding in 2022. 119,754 bitcoin was stolen and then sat, mostly unmoved, for years. The thieves' problem was that the chain remembers: as they moved about 25,000 of the coins out through exchanges, darknet markets and chain hopping, investigators traced the flow, using the common-ownership patterns that tie one entity's addresses together, until it reached accounts held by people they could name. Source: justice.gov

1. G102-01 The common-input-ownership heuristic 30 min
2. G102-02 Change addresses and behavioral fingerprints 30 min
3. G102-03 Clustering across services and chains 31 min
4. G102-04 When a heuristic is wrong 31 min

Opens with The Colonial Pipeline ransom, May 2021. The operator paid the DarkSide group about 75 bitcoin to restore a fuel pipeline serving the US East Coast. Source: justice.gov

1. G103-01 Following a transfer graph 30 min
2. G103-02 Through a mixer, and the peel chain 31 min
3. G103-03 Across bridges and chains 31 min
4. G103-04 The endpoint: exchange, seizure, or dead end 31 min

Opens with The MEV sandwich reversal of 3 April 2023. Sandwich bots make money by surrounding a victim's trade, buying just before it and selling just after to skim the price move they caused, and they had extracted value on Ethereum this way for years. Source: theblock.co

1. G104-01 What MEV is, and where it lives in the block 30 min
2. G104-02 Reading a sandwich 30 min
3. G104-03 Arbitrage, liquidations, and backrunning 31 min
4. G104-04 The MEV supply chain: builders, relays, and the reversal 31 min

Opens with Anchor Protocol and Terra, culminating in May 2022. Anchor paid depositors about 19.5 percent on the UST stablecoin, and where that yield came from was readable on-chain: not from borrower demand, which was far smaller than the deposits, but from a yield reserve that was visibly draining, for which Anchor asked the Luna Foundation Guard for about 450 million dollars in February 2022. Source: chainalysis.com

1. G105-01 A protocol's balance sheet on-chain 31 min
2. G105-02 Where the yield actually comes from 31 min
3. G105-03 Solvency, and reading a run 31 min
4. G105-04 The off-chain hole a query cannot see 31 min

Opens with Mango Markets, October 2022. Avraham Eisenberg drained about 110 million dollars by manipulating the price of the MNGO token to borrow against a position he had inflated, then publicly admitted the conduct while asserting it was legal. Source: cftc.gov

1. G106-01 An on-chain claim, and the confidence it supports 31 min
2. G106-02 Attribution: tying an address to an actor 31 min
3. G106-03 Writing the report 31 min
4. G106-04 Defending it against someone who pushes back 31 min

Opens with The Nomad bridge, 1 August 2022. In a routine upgrade Nomad set the value of a trusted message root to 0x00. Source: medium.com

1. G201-01 What an invariant is, and the one Nomad turned off 30 min
2. G201-02 Writing the invariants of a position you hold 30 min
3. G201-03 The invariant enforced by an assumption 31 min
4. G201-04 The invariant nobody wrote down 30 min

Opens with Cream Finance, 27 October 2021, its third major exploit of the year, for about 130 million dollars. The attacker flash-borrowed DAI from Maker, minted a large amount of the yUSD share token, then transferred Yearn Curve tokens straight into the vault so that the vault's reported price per share doubled. Source: medium.com

1. G202-01 Oracle and price manipulation 30 min
2. G202-02 The missing access check 30 min
3. G202-03 Reentrancy, and the order of operations 31 min
4. G202-04 Economic and governance attacks 30 min

Opens with Merlin DEX on zkSync, 26 April 2023. The team had said its pools would open only after CertiK finished its audit; the 14 April report found no critical issues, gave the protocol a security score of 90, and in its body flagged the owner's centralized privileges. Source: unchainedcrypto.com

1. G203-01 What an audit is, and what Merlin's did not say 30 min
2. G203-02 Scope, findings, and severity 30 min
3. G203-03 The centralization finding you cannot audit away 30 min
4. G203-04 The audit that found it 30 min

Opens with Compound governance Proposal 062, executed 29 September 2021. The upgrade split COMP rewards by a governance-set ratio, and the new Comptroller compared a value with the greater-than operator where it needed greater-than-or-equal, a missing character found in two places. Source: blocksec.com

1. G204-01 Reading a contract page on a block explorer 30 min
2. G204-02 Simulating a transaction before you sign 29 min
3. G204-03 Checking and revoking approvals 30 min
4. G204-04 Static analysis output a user can read 30 min

Opens with The Ronin bridge, which connected Ethereum to the Axie Infinity sidechain, 23 March 2022, about 624 million dollars. Withdrawals needed five of nine validator signatures, and the attacker controlled five: four run by Sky Mavis and a fifth run by the Axie DAO, which had allowlisted Sky Mavis to sign on its behalf during heavy load in November 2021 and never revoked it. Source: rekt.news

1. G205-01 What to watch, and the outflow nobody watched 31 min
2. G205-02 The compromise that leaves no on-chain trace 31 min
3. G205-03 Detection is the longest clock 31 min
4. G205-04 Your runbook when a position is at risk 31 min

Opens with Radiant Capital, 16 October 2024, about 50 million dollars by Radiant's own count. At least three long-standing contributors, on hardware wallets and in different places, each approved what their Gnosis Safe front-end showed as a routine transaction. Source: halborn.com

1. G206-01 The review a small team can actually run 31 min
2. G206-02 Blind signing, and verifying the payload 31 min
3. G206-03 The public function that should have been caught 30 min
4. G206-04 Who holds the keys 32 min

Opens with Rubixi, 2016. Rubixi was a smart contract for a pyramid-style game whose developer had renamed the contract from an earlier name but had not renamed its constructor, the special function that runs once at deployment to set the owner. Source: eprint.iacr.org

1. G301-01 A contract does what it says, not what you meant 33 min
2. G301-02 Access control: who is allowed to call this 33 min
3. G301-03 It is live and adversarial the moment it deploys 33 min
4. G301-04 Immutable: one mistake can be permanent and total 33 min

Opens with GovernMental, 2016. GovernMental was a Ponzi-style game that kept a growing list of every participant, and paying out required looping over and clearing that entire list. Source: eprint.iacr.org

1. G302-01 The EVM executes, and it charges gas 34 min
2. G302-02 An external call can fail, and returns a value 34 min
3. G302-03 Reentrancy: the call that calls back 33 min
4. G302-04 Arithmetic: overflow, and why the checks exist 34 min

Opens with Team Finance, October 2022. Team Finance provided token-locking services, and its migrate() function, meant to move a locked Uniswap v2 position to v3 for the owner of that lock, never checked that the liquidity it moved belonged to the lock presented, so an attacker locked a token of their own and migrated other projects' liquidity into a pair they controlled, keeping about 15.8 million dollars. Source: rekt.news

1. G303-01 How state is really laid out 34 min
2. G303-02 Upgradeability is power that must be guarded 34 min
3. G303-03 Trusting caller-supplied data and external code 33 min
4. G303-04 Return values, and tokens that misbehave 34 min

Opens with Yam Finance, August 2020. Yam launched to enormous demand, holding hundreds of millions of dollars in value within days, on a contract that had not been audited. Source: theblock.co

1. G304-01 Test the unhappy path you did not imagine 34 min
2. G304-02 Edge cases, and the math you did not fuzz 34 min
3. G304-03 Shipping unreviewed: the cost of skipping the work 34 min
4. G304-04 The migration and deployment checklist 34 min

Opens with Meerkat Finance, March 2021. Meerkat Finance was a yield vault that launched on BNB Chain and, a day later, drained about 31 million dollars of user deposits. Source: rekt.news

1. G305-01 Read who controls it: owner, upgrade, and mint 34 min
2. G305-02 Read the transfer and burn functions for hidden behavior 34 min
3. G305-03 Read the accounting and the reward math 34 min
4. G305-04 Read the inputs it trusts, and the ones it does not check 34 min

Opens with Value DeFi, November 2020. The day before, Value DeFi had posted a Twitter thread highlighting its flash-loan exploit prevention methodology. Source: rekt.news

1. G306-01 The hubris of knowing a little 34 min
2. G306-02 The audit, and the limits of an audit 33 min
3. G306-03 The practices and tools real builders live by 33 min
4. G306-04 Where to go next, and the honest handoff 34 min

Opens with QuadrigaCX, 2019. Canada's largest cryptocurrency exchange collapsed after its founder, Gerald Cotten, died in December 2018 as, the company said, the only person with the keys to its cold wallets, and about 184 million Canadian dollars in customer crypto was declared inaccessible. Source: osc.ca

1. G401-01 The single key, and QuadrigaCX 31 min
2. G401-02 The key ceremony 31 min
3. G401-03 Multisig governance for an institution 31 min
4. G401-04 MPC and the shape of key material 31 min

Opens with Prime Trust, 2023. A Nevada trust company that held crypto for other businesses went into receivership after Nevada's regulator petitioned in June 2023, finding it owed clients about 85.7 million dollars in fiat against about 2.9 million on hand. Source: coindesk.com

1. G402-01 Segregation of duties 31 min
2. G402-02 The hot-cold boundary at institutional scale 31 min
3. G402-03 Reconciliation, and the shortfall caught too late 31 min
4. G402-04 Change management and the four-eyes rule 32 min

Opens with SEC versus Ripple, filed December 2020. The Securities and Exchange Commission sued Ripple Labs alleging its XRP token was an unregistered security. Source: sec.gov

1. G403-01 Is it a security: the question under everything 32 min
2. G403-02 The US map: the SEC, the CFTC, and the taxonomy 32 min
3. G403-03 GENIUS, CLARITY, and reading a law in flux 33 min
4. G403-04 MiCA and the cross-border reality 33 min

Opens with Binance, November 2023. The largest cryptocurrency exchange in the world agreed to pay about 4.3 billion dollars to settle US charges that it had operated for years with willfully deficient anti-money-laundering controls, and its founder pleaded guilty and stepped down. Source: justice.gov

1. G404-01 Why AML exists, and what Binance paid to learn it 32 min
2. G404-02 KYC and the risk-based approach 32 min
3. G404-03 The Travel Rule, on-chain 33 min
4. G404-04 Sanctions screening and the block 33 min

Opens with Suex, September 2021. The US Treasury's OFAC sanctioned Suex, a cryptocurrency exchange, the first such designation of a crypto exchange, for acting as a conduit that laundered proceeds for ransomware operators and other criminals. Source: home.treasury.gov

1. G405-01 Screening an address before you touch it 32 min
2. G405-02 Tracing for a suspicious activity report 33 min
3. G405-03 Typologies: what laundering looks like to a compliance desk 33 min
4. G405-04 The false positive and the cost of being wrong 33 min

Opens with Gemini Earn and Genesis, 2022 to 2023. Gemini offered retail customers a yield product, Earn, that lent their assets to Genesis, a lender that abruptly froze withdrawals in November 2022, trapping around 900 million dollars belonging to roughly 340,000 Earn users. Source: sec.gov

1. G406-01 What an attestation proves, and Gemini Earn 32 min
2. G406-02 Financial reporting a regulator will accept 33 min
3. G406-03 Communicating risk to a board 33 min
4. G406-04 The disclosure that was owed 34 min

Opens with Ronin Capital, March 2020. Ronin was a proprietary trading firm and market maker that stood ready to buy and sell across many markets, and in the extreme volatility of mid-March 2020 it took losses that left it, in the CME's words, unable to meet its capital requirements going forward. Source: cmegroup.com

1. G501-01 Making markets means carrying inventory risk 34 min
2. G501-02 The spread is payment for risk, not a free lunch 34 min
3. G501-03 How a market maker handles your order 34 min
4. G501-04 Risk controls at machine speed 34 min

Opens with Two Sigma, disclosed 2023. Two Sigma is one of the most sophisticated quantitative hedge funds in the world, running strategies built and governed by teams of scientists, and it disclosed that one of its own researchers had made unauthorized changes to the firm's trading models, adjusting them in ways that left some funds overperforming by more than 400 million dollars and others underperforming by about 165 million, which Two Sigma repaid; the SEC fined it 90 million dollars. Source: sec.gov

1. G502-01 A model is a lever on real money 33 min
2. G502-02 Model governance: who can change what 34 min
3. G502-03 Marking to model, and marking to hope 33 min
4. G502-04 When the numbers are a story you tell yourself 34 min

Opens with The JPMorgan London Whale, 2012. Traders in JPMorgan's Chief Investment Office, one of them nicknamed the London Whale for the size of his positions, built an enormous book of credit derivatives that grew until it could not be exited without moving the market against itself. Source: hsgac.senate.gov

1. G503-01 A limit is only a control if it binds 34 min
2. G503-02 Value at risk, and what it does not see 34 min
3. G503-03 The loss hidden inside the model 34 min
4. G503-04 Concentration: the position you cannot exit 34 min

Opens with Societe Generale and Jerome Kerviel, 2008. Kerviel, a trader at the French bank Societe Generale, built enormous unauthorized directional positions, tens of billions of euros in notional, and hid them by entering fictitious offsetting trades that made his book appear balanced and within limits. Source: societegenerale.com

1. G504-01 The rogue trader is a control failure first 34 min
2. G504-02 Segregation of duties, and why it exists 34 min
3. G504-03 Reconciliation catches the trade that is not there 33 min
4. G504-04 The hidden loss always grows 34 min

Opens with Banc De Binary, 2016. Banc De Binary was one of the largest sellers of binary options to retail customers, marketing them as a simple way to profit from a market moving up or down, and US regulators charged it with selling them in the United States without registering and off any exchange; it paid settlements to the CFTC and SEC totaling around 11 million dollars in 2016 and closed itself in January 2017. Source: sec.gov

1. G505-01 Ask how the business makes money 34 min
2. G505-02 Copy trading and the economics of the platform 34 min
3. G505-03 The funded-account challenge, and who profits 34 min
4. G505-04 When the product is designed for you to lose 34 min

Opens with The Galleon Group and Raj Rajaratnam, 2009. Rajaratnam ran the Galleon Group, a multi-billion-dollar hedge fund with a track record that had attracted serious institutional money, and it emerged that a meaningful part of his edge came from illegal insider information, not skill; he was convicted of securities fraud and conspiracy and sentenced to eleven years in prison, and Galleon collapsed. Source: justice.gov

1. G506-01 A track record is how the numbers were made 34 min
2. G506-02 What due diligence actually checks 34 min
3. G506-03 Survivorship, selection, and the record you show 33 min
4. G506-04 The record that cannot answer the second question 34 min

Opens with Binance USD (BUSD), February 2023. BUSD was a dollar stablecoin issued by Paxos, fully reserved and regulated, and by that month one of the largest in the world. Source: dfs.ny.gov

1. G601-01 What a stablecoin promises, and who can revoke it 32 min
2. G601-02 Reserves, redemption, and the run 32 min
3. G601-03 How a peg is actually held 33 min
4. G601-04 The freeze switch 32 min

Opens with Silvergate Bank and the Silvergate Exchange Network, March 2023. Silvergate was a small California bank that had become critical plumbing for the industry: its Silvergate Exchange Network let exchanges and trading firms move US dollars between each other instantly, around the clock, which is what real payments and settlement need. Source: federalreserve.gov

1. G602-01 Accepting a payment is settling it 33 min
2. G602-02 The merchant's real risks: volatility, finality, and the refund 33 min
3. G602-03 The on-ramp and off-ramp between dollars and crypto 33 min
4. G602-04 Concentration: when the rail is a single point of failure 33 min

Opens with Synapse and Evolve Bank, 2024. Synapse was a middleware company that connected consumer fintech apps to a partner bank, Evolve, so apps could offer accounts, payroll and payments without being banks themselves. Source: bankingdive.com

1. G603-01 Who holds the balance, and can they prove it 33 min
2. G603-02 Paying a workforce: batch payments and their failure modes 33 min
3. G603-03 Contractors, cross-border, and the compliance that attaches 33 min
4. G603-04 Reconciling a payment ledger you do not control 33 min

Opens with The Bangladesh Bank heist, February 2016. Attackers who had penetrated the Bangladesh central bank's systems sent fraudulent payment instructions over SWIFT, the messaging network banks use to move money across borders, requesting nearly a billion dollars be transferred out of its account at the Federal Reserve Bank of New York. Source: newyorkfed.org

1. G604-01 A cross-border payment is a chain of trust 34 min
2. G604-02 Corridors: liquidity, correspondents, and cost 33 min
3. G604-03 Settlement risk and finality across borders 33 min
4. G604-04 Where stablecoins change the corridor, and where they do not 33 min

Opens with The New York Attorney General settlement with Tether and Bitfinex, February 2021. Tether issued the largest dollar stablecoin, USDT, on the representation that each token was backed one for one by dollars in reserve. Source: ag.ny.gov

1. G605-01 What GENIUS makes checkable 33 min
2. G605-02 Reserves and redemption as legal obligations 33 min
3. G605-03 The issuer as a regulated entity 33 min
4. G605-04 AML on a stablecoin the world can hold 33 min

Opens with Citibank's mistaken payment to Revlon's lenders, August 2020. Citibank, acting as agent on a Revlon loan, meant to send a roughly 8 million dollar interest payment. Source: courtlistener.com

1. G606-01 The payment that could not be undone 33 min
2. G606-02 Giving software the authority to pay 33 min
3. G606-03 Reputation and staking: trusting an agent 33 min
4. G606-04 The micropayment economy, and the limits that make it safe 34 min

Opens with Fernandes, Lynch and Netemeyer, Management Science, 2014. A meta-analysis of 168 papers covering 201 studies of financial literacy and financial education found that interventions to improve financial literacy explained 0.1 percent of the variance in the financial behaviors studied, with weaker effects in low-income samples, and that the effect of financial education decays with time: even large interventions with many hours of instruction had negligible effects on behavior 20 months or more after delivery. Source: ideas.repec.org

1. G701-01 What teaching this material has to overcome 33 min
2. G701-02 The autopsy method: teaching from a documented failure 33 min
3. G701-03 Assessment that measures instead of certifies 33 min
4. G701-04 The Academy's methods, and why each one exists 34 min

Opens with Kornell and Bjork, Psychological Science, 2008. Participants studied six paintings by each of twelve artists, some artists' works presented consecutively and some interleaved with other artists', then were tested on attributing new paintings to the artists. Source: bjorklab.psych.ucla.edu

1. G702-01 Retrieval and spacing, against the feeling of learning 32 min
2. G702-02 Metacognition: teaching people to know what they know 32 min
3. G702-03 Worked examples and cognitive load 32 min
4. G702-04 Transfer: from a passed quiz to a changed decision 32 min

Opens with Kim Kardashian and EthereumMax, 3 October 2022. The Commission found that Kardashian had been paid $250,000 to publish an Instagram post about EMAX tokens, the crypto asset security offered by EthereumMax, with a link to the project's site and purchase instructions, and, although the post carried #AD, had not disclosed that the issuer paid her or how much. Source: sec.gov

1. G703-01 The compensated voice 32 min
2. G703-02 Directed silence: when the sponsor tells you not to disclose 31 min
3. G703-03 The educator who became the funnel 31 min
4. G703-04 The disclosure rule you will actually follow 32 min

Opens with The Bored Ape Yacht Club Discord, 4 June 2022. The Discord account of the project's community manager was compromised and used to post a phishing link, dressed as an exclusive giveaway for holders, in the official BAYC and Otherside servers. Source: coindesk.com

1. G704-01 The server is the attack surface 31 min
2. G704-02 Admin accounts and the privilege ladder 32 min
3. G704-03 Social engineering of the people who hold the keys 32 min
4. G704-04 The recovery scam inside your own community 32 min

Opens with Ronin Network, 23 to 29 March 2022. An attacker used five of the bridge's nine validator signatures to withdraw 173,600 ETH and 25.5 million USDC, about $624 million, in two transactions. Source: rekt.news

1. G705-01 The first hour, at community scale 32 min
2. G705-02 Containment and the response clock 32 min
3. G705-03 Detection, disclosure and the cost of silence 31 min
4. G705-04 After: the second wave and the postmortem 31 min

Opens with CFPB v. BloomTech and Austen Allred, 17 April 2024. Source: files.consumerfinance.gov

1. G706-01 Cohorts, completion and the honest number 31 min
2. G706-02 Promises you can keep 31 min
3. G706-03 When the institution fails the student 32 min
4. G706-04 Marking under pressure: assessment integrity 33 min

Opens with Telegram and the TON blockchain, 2020. Telegram raised about 1.7 billion dollars from investors by selling rights to a token, Gram, that it planned to launch on its TON blockchain, treating the sales as exempt private offerings and the Grams themselves as a currency. Source: sec.gov

1. G801-01 Is the token a security 33 min
2. G801-02 What registration and disclosure require 33 min
3. G801-03 Exemptions, and the conditions that come with them 33 min
4. G801-04 The tokenized asset that is a security, and what follows 33 min

Opens with Enron, 2001. Enron used special-purpose vehicles, separate legal entities, to move debt and risky assets off its own balance sheet, and the whole point of such a vehicle is to isolate assets and liabilities from the parent so each stands on its own. Source: sec.gov

1. G802-01 Why the SPV exists 33 min
2. G802-02 Bankruptcy remoteness, and what breaks it 33 min
3. G802-03 The claim the token actually represents 34 min
4. G802-04 When the sponsor fails: does the asset survive 34 min

Opens with The Qingdao port metals fraud, 2014. At the port of Qingdao in China, a trading company used warehouse receipts, documents certifying that specific metal, copper and aluminum, was held in a warehouse, to borrow money, and it pledged the same metal to multiple lenders at once, and in cases the metal was not there in the quantities the receipts claimed. Source: web.archive.org

1. G803-01 The token is a receipt for an off-chain asset 33 min
2. G803-02 Custodian selection: who actually holds the asset 33 min
3. G803-03 Attestation: proving the asset is there, and pledged once 33 min
4. G803-04 Transfer agent and registry: one record, on-chain and off 34 min

Opens with Abraaj Group, 2018. Abraaj was one of the largest private-equity firms in emerging markets, managing billions, and it collapsed after investors questioned what had happened to money in its funds. Source: sec.gov

1. G804-01 The value is a claim until it is governed 33 min
2. G804-02 NAV, and the independent valuation that anchors it 33 min
3. G804-03 Oracles for a real-world asset: pricing what is off-chain 34 min
4. G804-04 Programmable compliance: the rules a token enforces on itself 34 min

Opens with The Woodford Equity Income Fund, 2019. This was a large, popular UK investment fund that let ordinary investors put money in and take it out on demand, an open-ended, daily-dealing fund, while it held a growing portion of its money in illiquid assets that could not be sold quickly. Source: fca.org.uk

1. G805-01 The liquidity mismatch: instant token, illiquid asset 34 min
2. G805-02 Redemption engineering: honoring the token with the underlying 35 min
3. G805-03 Gating provisions: designing the pause before the run 34 min
4. G805-04 Secondary market liquidity for a restricted token 34 min

Opens with Maple Finance and Orthogonal Trading, December 2022. Maple ran on-chain lending pools where lenders deposited funds that were lent to vetted borrowers, a way of bringing real-world credit on-chain, and Orthogonal Trading was one of its large borrowers. Source: theblock.co

1. G806-01 Credit risk comes through the on-chain door 34 min
2. G806-02 Cross-border distribution under MiCA and comparable regimes 35 min
3. G806-03 RWA as DeFi collateral: inheriting the underlying's risk 35 min
4. G806-04 Composability, and how one default spreads 34 min

Opens with The Facebook IPO on Nasdaq, 18 May 2012. Nasdaq's system for opening the most anticipated IPO in years entered a loop in its order-matching software under a flood of orders and cancellations, and for over two hours it could not tell firms whether their orders had executed. Source: sec.gov

1. G901-01 Your system is only as good as its data feed 34 min
2. G901-02 Acting on unverified data: the signal that was a lie 34 min
3. G901-03 When the feed goes dark 34 min
4. G901-04 The consolidated feed is a single point of failure 34 min

Opens with BitMEX during the crash of 12 to 13 March 2020. As the price of Bitcoin fell by nearly half in a day, the crypto derivatives exchange BitMEX was knocked offline at the worst moment by a botnet's denial-of-service attack, which it first misdiagnosed as a failed disk at its cloud provider, and was hit again ten hours later. Source: web.archive.org

1. G902-01 A venue is infrastructure that goes down under load 34 min
2. G902-02 Rate limits and reachability when everyone trades at once 34 min
3. G902-03 The venue can cut you off 34 min
4. G902-04 Even the largest exchange can go dark 33 min

Opens with The BATS IPO, 23 March 2012. BATS, an electronic exchange, listed its own shares on its own exchange, and a bug in its matching engine's handling of symbols in a particular range sent its matching engine into a loop, its own stock fell from 16 dollars to fractions of a cent as it began trading, and erroneous prints in Apple triggered a five-minute halt. Source: sec.gov

1. G903-01 The order-management layer, and the state it must not lose 34 min
2. G903-02 The fat finger, and the order you cannot cancel 34 min
3. G903-03 Reconciliation: knowing what you actually did 34 min
4. G903-04 Gross versus net, and the control that catches it 34 min

Opens with Waddell and Reed and the Flash Crash, 6 May 2010. A large asset manager used an automated execution algorithm to sell about 4.1 billion dollars of stock-index futures to hedge a position, and the algorithm was set to target a fixed percentage of trading volume with no limit on price and no limit on time. Source: sec.gov

1. G904-01 An execution algorithm needs price and time limits 34 min
2. G904-02 Executing into thin liquidity 34 min
3. G904-03 The erroneous order sent to the market 34 min
4. G904-04 Spoofing: the orders you never meant to fill 34 min

Opens with Victor Niederhoffer's fund, 1997. Niederhoffer was a celebrated trader and an early user of computers to predict short-term moves, whose strategy included selling out-of-the-money options, collecting steady premiums that had worked for years and looked excellent in the record. Source: euromoney.com

1. G905-01 The backtest that hid the tail 34 min
2. G905-02 Overfitting: a pattern that was only noise 34 min
3. G905-03 The regime your data never contained 34 min
4. G905-04 Chasing a signal that means nothing 34 min

Opens with Infinium Capital Management, February 2010. Infinium put live a new automated strategy, meant to trade an energy ETF against crude oil futures, after only one to two hours of back-testing; within its first seconds it malfunctioned and sent 6,767 orders in about three seconds, and NYMEX later fined the firm for failing to supervise, test and control it. Source: web.archive.org

1. G906-01 The kill switch that stops it faster than a human 34 min
2. G906-02 Risk limits and the loss your model said was impossible 34 min
3. G906-03 Your algorithm's market impact is your responsibility 34 min
4. G906-04 Running strategies on other people's capital 35 min