The control loop, reconstructed
The SEC-CFTC joint report of September 2010 identifies a single triggering order: a sell program in E-mini S&P 500 futures for 75,000 contracts, notional roughly $4.1 billion, submitted by a mutual-fund complex (Waddell & Reed). The execution algorithm was set to a participation rate of 9% of trailing one-minute volume. No price limit. No time limit. No volatility throttle. Given the inputs it had, the algorithm executed exactly as written.
The pathology is in the specification, not in the code. As the algorithm sold into a softening tape, traded volume rose — partly because of its own prints. Higher trailing volume raised the algorithm's per-minute target, which made it sell faster. Faster selling pressured the bid, pulled in cross-market arbitrageurs and de-risking flow, raised volume again, and the target stepped up again. In control-theory language this is positive feedback with no damping term and no anti-windup. Such a loop will either oscillate or run away. On May 6 it ran away. A ΔVolume input drove a ΔSell-rate output, which fed back into ΔVolume with a gain greater than one, and the system slid into the regime where the linear approximation stops being useful at all.
Phase 1 — the slide, roughly 1:00 to 2:32 PM
The tape was already weak. Greek, Portuguese, and Spanish sovereign spreads were the morning story; the S&P 500 was down around 2.5% by early afternoon. Implied σ on index options was elevated and dealers were already shading quotes wider than baseline. Microstructure depth was running closer to the edge of its normal envelope than on a typical session. Nothing pathological yet. The conditions were just unfavourable.
Phase 2 — disintegration, 2:32 to 2:47 PM
In fifteen minutes the Dow fell from roughly 10,460 to an intraday low near 9,870. The last two of those minutes are where the order book visibly came apart. A representative slice of prints from the tape:
| Stock/ETF | Reference price | Flash Crash extreme | Implied move |
|---|---|---|---|
| Accenture (ACN) | ~$40 | $0.01 | −99.97% |
| Procter & Gamble (PG) | ~$60 | $39.37 | −37% |
| 3M (MMM) | ~$82 | $68 | −17% |
| iShares Russell 1000 (IWB) | ~$63 | $0.01 | −99.98% |
| Sotheby's (BID) | ~$34 | $100,000 | +294,017% |
Sotheby's at one hundred thousand dollars is the clarifying observation. That is not a mispricing in the valuation sense. It is a matching-engine event: a marketable buy order crossed against a resting stub quote at $100,000 because nothing closer to the inside was left on that side of the book. The penny prints on the sell side are the same mechanism reflected. The book at those depths was not thin. It was empty — populated only by placeholder quotes that market makers were obligated to post and never intended to be hit.
Phase 3 — recovery, 2:47 to roughly 3:07 PM
Buyers came back almost immediately. The Dow recovered close to 600 points in about ten minutes. Over 20,000 trades were later busted under the exchanges' clearly-erroneous rules, across more than 300 symbols. For traders who had filled at $0.01, that was the right outcome. It is also a useful data point on the prints themselves: the cleanest evidence that a price was not real is that the exchange, on review, agreed.
HFT was a regime-conditioned variable, not a cause
The retail framing of the Flash Crash as an HFT failure is close to right and off by one layer. HFT firms did not initiate the move. The trigger was a large size sell into an already weak tape. What HFT firms did was what any inventory-constrained market maker does when the signal-to-noise of incoming flow degrades: they widened quotes, reduced size, and, at the limit, withdrew. In the order-book reconstructions, visible depth at the inside collapsed by roughly an order of magnitude in seconds.
The phase-space analogy is the cleanest one I know for this. Picture the joint state of the order book as a point in a high-dimensional space whose axes are inside spread, depth at five levels, quote-update rate, trade-size distribution, and short-horizon realised σ. Under normal conditions the point sits inside a small attractor: tight spreads, deep book, frequent small updates. The market makers' models are calibrated against that attractor. A large enough perturbation kicks the point outside the basin, and once outside, the dynamics that pulled it back stop being the dominant ones. There is a different attractor at the edge of the space — wide spreads, empty book, sparse updates — and during the fifteen minutes in question, the system found it. The recovery was the system being yanked back across the basin boundary by the circuit-breaker pause in E-mini futures and by buyers who decided the regime had reverted.
I disagree with the common reading that HFT firms abandoned the market in bad faith. They did not. They followed their risk limits. Any liquidity provider who keeps quoting tight into toxic order flow gets adversely selected to insolvency — that is the whole reason their normal-regime quotes are tight in the first place. The substantive complaint is not that HFT behaved badly. The complaint is that retail and buy-side infrastructure was built on the implicit assumption that observed depth is real depth. It is not. Depth is conditional. Under stress the conditioning fails.
Or, more carefully: the failure mode is not that liquidity disappeared. It is that the disappearance was correlated across providers. Every inventory-sensitive algorithm reads similar features — order-flow imbalance, realised short-horizon σ, quote-update frequency, trade-size distribution. When the regime breaks, every algorithm reaches a similar conclusion at roughly the same time. The withdrawal was synchronised not because firms coordinated but because they were fitting comparable functions to comparable inputs. Assuming stationarity of the liquidity regime, the resulting depth is real. Drop the stationarity assumption and the depth evaporates jointly. That joint behaviour does not show up at all in normal-day backtests.
Sarao, and what his case does and does not establish
In 2015 the US Department of Justice charged Navinder Singh Sarao, a trader operating from his parents' house in Hounslow, west London, with contributing to the crash through spoofing — entering large sell orders he intended to cancel, in order to induce other algorithms to react to a phantom imbalance. He pleaded guilty and received one year of home detention.
Sarao is a cleaner villain than the data supports. His activity was real, illegal, and present on the tape during the relevant minutes. But the CFTC's own reconstruction is unambiguous: the primary trigger was the Waddell & Reed sell program, not Sarao. What Sarao's order flow contributed was degraded quality of the order-book signals that other algorithms were reading. That probably accelerated the early part of the slide. Probably. The counterfactual is not recoverable. You cannot re-run May 6 with Sarao removed from the tape and observe the difference in expectation.
The transferable observation is infrastructural, not narrative. A retail-tier trader, using modified off-the-shelf software, from a residential address in a London suburb, was able to inject orders into the US equity-futures complex in sizes that registered at the market-wide level. The access was legitimate. The tools were legal to acquire. The misuse was the spoofing, not the access. That observation is still mostly accurate today, modulo improvements in venue-side spoof detection.
What this means for anyone running a strategy
The Flash Crash is the high-visibility empirical demonstration of a result the microstructure literature had already produced: in modern electronic markets, depth is regime-dependent, and the regimes are correlated across providers. The implication for backtesting is direct. Any strategy whose realised P&L includes fills inside spreads that would not have existed on an ordinary tape is, in part, being paid by the tail rather than by an arbitrage on a signal. The backtest cannot distinguish the two unless it explicitly measures liquidity conditions at the moment of each fill.
The right backtesting question is not "what would this strategy have returned over 2010-2023?" The right question is "what would it have returned on the worst fifty days of 2010-2023, with the realised liquidity those days actually had?" The two answers usually differ by a meaningful factor. If the strategy is healthy on the second cut, deploy. If it is healthy only on the first cut, what looks like edge is partially compensation for tail risk that has not yet shown up in the sample.
I'll flag this with a personal note, briefly. I ran a short-horizon mean-reversion strategy on US large-caps for about six months in 2021. In-sample Sharpe near 1.6 on the 2015-2020 fit. Live Sharpe close to 0.4. The gap was almost entirely fills: my historical fills assumed mid-quote minus half-spread, my live fills did not get there on the days that mattered. I discontinued the strategy. The lesson was not that the signal was wrong. The signal was fine. The liquidity model was wrong, and the liquidity model was the part of the system I had not stressed against a regime break.
The same logic applies to small-cap and OTC books with more force. The penny stock and micro-cap tape lives, structurally, in the regime that large-caps briefly visited on May 6, 2010. Spreads are wide on quiet days. Depth is thin on quiet days. If Accenture could clip to $0.01 with HFT support theoretically present, a $5 million OTC name can clip on an ordinary Tuesday afternoon with no national catalyst at all. The Flash Crash is not an exotic event for that book. It is the baseline.
What the regulators changed
The post-event regulatory response was concrete and, on the whole, effective at preventing a re-run of the specific failure mode.
Limit Up-Limit Down (LULD). Per-name bands that pause trading when a stock moves more than a defined percentage (5-20%, depending on price tier and reference volatility) within a five-minute window. This is the mechanism that makes another Accenture-at-$0.01 print effectively impossible on a listed name. Bands are calibrated to tolerate ordinary volatility and arrest the pathological case.
Market-wide circuit breakers, retuned. The breakers inherited from the Black Monday 1987 response were recalibrated. Level 1 (7% S&P 500 decline) halts trading for 15 minutes. Level 2 (13%) adds another 15 minutes. Level 3 (20%) closes the session. They were exercised in March 2020 and performed as designed.
Stub-quote elimination. Market makers must post two-sided quotes within a defined percentage of the NBBO. A quote at $0.01 against a $40 stock is no longer a permissible placeholder. This removes the specific matching pathology that produced the worst prints.
Clearly-erroneous trade rules, harmonised. Cross-exchange standards for busting trades that execute far from prevailing prices. Useful, and a reminder that any strategy whose P&L depends on fills that look as though they could be erroneous is running revocable P&L.
Consolidated Audit Trail (CAT). A regulatory plumbing project, much harder and later than originally planned, that now permits regulators to reconstruct order-by-order activity across US equity venues. Mostly invisible to traders. It mostly matters for post-event forensics.
Operational translations
The implications for an active trader are narrow and practical. Use limit orders in any name where depth might be conditional. A market order during a liquidity vacuum executes against whatever resting quote the book has, including quotes that should not have been resting at that price. A limit order either fills at your stated price or does not fill. Non-fill is a valid outcome.
Be deliberate about stop-losses. A stop that triggers into a market order is a structural exposure to flash-crash-style dislocations — it can fill well below the stop, including at the stub. A stop-limit avoids the absurd fill at the cost of sometimes not filling at all. Which risk you prefer is a position-specific choice. It should be a conscious choice, not a default. Most retail platforms ship the dangerous default.
Size against realised depth, not displayed depth. The liquidity visible in the order book at the sizes shown is not the liquidity that will be available during a stress event. A working approximation: depth available under stress is closer to the size at the top of the inside than to cumulative depth across five levels. Set position size against that number, not the optimistic one.
Do not chase absurd prints. The traders who bought ACN at $0.01 had their fills busted. Traders who saw a $500 name print at $5 and tried to participate received nothing — the exchange intervened. In a dislocation the rational action is to stop trading until normal price discovery resumes. The apparent opportunity is not an opportunity in any sense the clearing system will respect.
What May 6 is actually evidence of
Modern equity markets are fast, cheap, and deep under normal conditions. Under stress they are still fast and still cheap. The depth, however, is a function of regime, not a permanent property of the market. Microstructure researchers have carried this result for some time. The Flash Crash is its most-watched empirical exhibit. Retail intuition has not entirely caught up. A trader whose whole tape is post-2010 has not seen the machinery fail. The March 2020 circuit-breaker triggers came close at the index level but were arrested by design before microstructure broke. Absence of a visible failure is not evidence of durability.
One residual uncertainty I want to flag, because the public data does not resolve it. I described the HFT withdrawal as rational and correlated because firms fit similar functions to similar inputs. That is the tidy version. The messier version is that I do not know what fraction of the withdrawal was automatic risk-limit breach and what fraction was discretionary judgment by humans behind the systems. The published reconstruction does not separate the two. The answer probably differs firm by firm. The distinction matters for any future event in which the regime shift is slower and automated risk limits do not trigger cleanly. A clean answer is not available.
Model assumptions, on the record for this article: the account above rests on the SEC-CFTC joint report of September 2010 and on the CFTC's 2015 complaint against Sarao. The mechanism description treats published order-book snapshots as reflecting the actual visible book at the time, which is approximately but not exactly true. A market that processes billions of dollars per second and still admits the topology described above is fragile in a specific, identifiable way. That fragility was patched at the edges. It was not removed.
See also: Black Monday 1987 · The 2008 Financial Crisis · Order Types · Scalping · Trading Psychology: Fear and Greed
