Capital · Risk
Why Trading Firms Die
Knight Capital, FTX, and a $45 billion AI fund didn't run out of alpha. The three speeds at which trading firms die, and the controls against each.
Capital · Risk
Knight Capital, FTX, and a $45 billion AI fund didn't run out of alpha. The three speeds at which trading firms die, and the controls against each.
In brief
Knight Capital was one of the largest market makers in US equities. It lost $440 million, and its independence, in forty-five minutes. FTX was one of the largest crypto exchanges on earth, and Alameda Research, its sibling trading firm, one of crypto’s largest market makers and OTC desks. From a leaked balance sheet to bankruptcy for both, an eight-billion-dollar hole and all: about a week. Situational Awareness was an AI-thesis hedge fund reportedly running $45 billion at its peak; one month of falling AI stocks later, margin calls forced it to sell its public stock book to Citadel at a discount.
Different eras, different markets, different asset classes, and one thing in common: not one of them ran out of alpha. Knight’s market making worked. FTX’s exchange printed revenue, and Alameda had real, if declining, edges. The fund’s thesis may yet prove right. In each case, the core business still had a viable strategy. The decisive failure sat outside it: a deployment, a missing wall between customer money and a trading firm, a hedge that was not a hedge.
Ask a fund operator what keeps them up at night and you’ll usually hear a version of the same answer: our edge is decaying, we need better signals, we need faster models. Alpha generation gets most of the hiring budget, most of the intellectual energy, and nearly all of the ego.
But the graveyard tells a different story. Trading our own capital since 2018, through two crypto winters and the largest exchange collapse in the industry’s history, we’ve watched firms with better capital, better talent, and better signals than ours disappear. Almost none were killed by a bad strategy. The famous deaths, and the quiet ones nobody writes about, trace back to deployments, counterparties, reconciliation gaps, and concentration. Survivability is a function of three things: operations, risk management, and strategy diversification. Alpha decides how much you make. Those three decide whether you’re still here to make it.
The myth survives contact with the graveyard because it isn’t an information problem; it’s an identity problem. In this industry, alpha is where identity lives: a signal is proof of intelligence, the thing that makes a quant a quant. Nobody’s self-image, or comp narrative, is built on their kill switch. So the smartest people compete to work on signals, and budget follows self-image rather than failure probability.
Most firms overinvest in alpha and underinvest in operations, risk management, and diversification. They build a Ferrari engine and bolt it to a go-kart frame.
Trading firms increasingly look like tech companies. They can’t operate like them, and the differences line up with the ways they die.
Mistakes compound in milliseconds. Most businesses can ship fast and fix later. In trading, the feedback loop between error and consequence is measured in milliseconds, not sprints. A bug that runs for 45 minutes can end the firm.
The operating model is a hybrid. A trading firm has to run as three organizations at once: a technology company (complex software, continuous deployment), a financial institution (risk, capital, counterparties), and an operations center (real-time monitoring, incident response, zero tolerance for downtime). Most founders deeply understand one of these and have a passing familiarity with the other two. The financial-institution part is the one engineers underprice, because its risks sit quietly on a balance sheet instead of throwing errors.
Capacity is endogenous. In SaaS, more customers means more revenue. In trading, more capital doesn’t mean more returns: every strategy has a point at which your own orders move the market against you. Scaling means finding new edges, not adding capital to old ones.
A/B tests cost P&L, and the arms interact. We run live A/B tests: parallel variants of a strategy trading real money side by side. Every arm pays for its own sample in realized P&L, and unless the experiment is set up carefully the variants compete for the same fills or confound each other’s results. In software the control group is free; in trading there is no free control group, and the gap between simulation and live is where fortunes are lost. Validating a new edge is expensive, which is why firms keep trading old ones past their expiry.
Put those together and you get three ways to die, sorted by speed:
Every trading-firm failure we know of fits one of these three.
August 1, 2012. Knight Capital, then one of the largest market makers in US equities, was going live on a new NYSE retail program, with a launch date fixed by the exchange and roughly a month to build for it. The deployment was manual: in the days before launch, a technician copied the new code to the production servers by hand, with no second engineer reviewing the copy and no automated check that it landed everywhere. It missed one of the eight. That eighth server still carried a dormant module from years earlier, and the new code had reused its old activation flag, so at the open the orphaned server began firing orders from a defunct strategy at full speed. Then, under pressure to fix it live, engineers diagnosed the new code as the culprit and rolled it back from the seven healthy servers, spreading the defect to all eight. Forty-five minutes and several billion dollars of unwanted positions later, Knight had realized a ~$440 million loss, roughly four times its prior-year earnings. It survived only by emergency rescue financing and was absorbed by a competitor within the year.
The lesson isn’t the specific bug; it’s that nothing in the chain was a trading decision. A hand-run deploy under a deadline someone else set, no verification that it landed, and a panicked fix that made it worse: process failures, priced by the market at $440 million. The thing that kills you won’t be the thing you’re optimizing for. It will be the thing you assumed was fine.
None of what killed Knight requires heroics today. The fix is automated deploy discipline, the kind our own pipeline enforces: a release passes its gates (interface compatibility, dependency and version checks, tests) or never reaches production; what shipped is verified to be running on every node; rollback is a tested path, not a 4 a.m. improvisation. Add kill switches that don’t ask permission, reconciliation that runs continuously rather than nightly, and alerting that reaches a human who can act. None of them generate a basis point of alpha. All of them are why you still have a book.
FTX wasn’t a trading failure. What destroyed a dominant, profitable exchange was the routing of customer deposits to its sibling trading firm, Alameda Research. A jury convicted FTX’s founder of that fraud in November 2023. Months of massive revenue could not paper over that hole. We were trading on FTX when it collapsed in November 2022. Our systems saw FTX’s prices detach from the rest of the market, we triggered our exit protocols, and we got most of our funds out before withdrawals froze. That week gets its own piece, Same Starting Line, Different Paths. The short version: counterparty risk is not a footnote in crypto; it is a first-class risk. It cost others everything. A rule decided in advance is why it cost us five figures and two and a half years of waiting.
And this death is not crypto-specific. In July 2026, Situational Awareness, Leopold Aschenbrenner’s AI-thesis hedge fund, reportedly running roughly $45 billion at its peak on leverage of up to 400%, took losses on both sides of its book at once: the long AI-infrastructure bets fell while the bearish software positions meant to hedge them went the wrong way. Margin calls from its prime brokers forced it to sell its leveraged public stock book to Citadel at a discount. Reported assets dropped from about $45 billion to around $10 billion inside a month. The thesis may yet prove right. The leverage, and the hedge that wasn’t a hedge, decided the outcome before the thesis got a vote.
Notice that both endings were fast: FTX went from a rival’s tweet to bankruptcy in about a week, and Situational Awareness’s fire sale played out in days. This death runs on two clocks. The exposure builds quietly for months or years (a venue trusted too much, a bank, a margin arrangement, a hedge that only works in calm), carried every day without being priced. Then a trigger lands: a tweet, a leaked balance sheet, a margin call. You die in days; you were killed over months. The death is named for the slow clock because the slow clock is the one you can manage. Inside the run, the only control left is a decision you made before it started.
The controls here are structural, not clever: exposure limits per venue and per counterparty, capital that moves on triggers rather than opinions, isolation between books, and reconciliation that treats every external balance as a claim to verify, not a fact.
The slowest death gets the least attention because there’s no headline, just a strategy whose edge erodes until the firm quietly returns capital. Edges get crowded. Market structure shifts. Fee schedules change. Regimes end. Every strategy has a half-life, and a firm concentrated in one edge is a firm with an expiration date it hasn’t computed.
We know this one from the inside. Over eight years we’ve retired entire strategy classes after the data said the edge wasn’t there, including approaches that looked excellent in backtests and that much of the market still trades. That map of what doesn’t work is why we treat diversification as infrastructure: the system that detects decay and rotates capital is worth more than any single signal it monitors.
The pattern repeats across whole strategy classes. Simple cross-venue arbitrage printed money in crypto’s early years; those spreads are now competed down to the cost floor of the fastest, cheapest operators. Simple mean reversion had a long profitable run before crowding ground it toward zero. None of these edges “failed.” They matured: the returns migrated to the handful of firms with the lowest costs and the fastest infrastructure, and much of the market is still paying tuition to rediscover that.
The control against death by years is a portfolio and a process: multiple uncorrelated edges, continuous performance monitoring against expectation, and the discipline to kill a strategy the data has already killed, before it takes the firm with it.
Every firm that lasts writes entries of its own into this ledger. Ours are small so far, partly by design and partly by luck, and we keep one from each speed.
By minutes. The entry we study hardest is a death that didn’t finish. On an ordinary evening in March 2026, our hourly state verification came back red: the book our strategies believed (flat, orders closed, nothing at risk) did not match the venue’s. A venue had confirmed orders as filled without delivering the records of the fills themselves, and the fallback built for exactly that gap had been disabled by the same code path that hit the bug. The check that caught the drift then hit a dead end: an error state with no escalation path. Six hourly checks failed the same way before anyone acted, and the kill switch, built for exactly this moment, was crashing and retrying in a loop.
We reconciled the books by hand and restarted. Within two minutes the same mechanism dropped 54 more fills. The restart had fixed the data, not the mechanism, and strategies stacked fresh positions on top of exposure they couldn’t see until the venue’s own balance limits stopped them. The ledger says we made a small profit that night: the unintended exposure, a few thousand dollars of notional at our deliberately small scale, happened to close into a rally. We recorded it as a failure anyway. The same mechanism with the price moving the other way is a loss with no bound we controlled.
What came out of it: a fill pipeline whose fallback the primary path cannot disable, an intermediate order state that blocks new risk while fills are being recovered, automatic strategy pause on repeated rejections, a kill switch that distinguishes fatal from transient errors, and a restart rule that requires proving the pipeline healthy, not just the books balanced.
By months. The FTX collapse handed us a natural experiment in what counterparty risk actually is. One of our withdrawals showed “processed” on FTX’s side, but the transfer was never made. Those funds never left the exchange, and they came back only in 2025, through the bankruptcy queue, at about 120 cents on the dollar. Our banks were Silvergate and then Signature, the two pillars of crypto banking. Both failed in March 2023, four months after FTX, and both returned every dollar we held. Three failed counterparties. Two very different recovery structures: a failed bank winds down under regulators whose first job is protecting depositors; a failed exchange goes through a bankruptcy queue, where balances become claims that wait years. That’s the lesson we priced in: counterparty risk is not the size of the exposure but the structure holding it. A dollar on an exchange, a dollar at a bank, and a dollar in transit are three different risks, and each place money rests gets its own limit.
By years. The slow-death entry is passive market-making on the major pairs: quote both sides, earn the spread, collect the maker rebate. Seven versions of signals and gates tried to make it work, and each backtest found a reason for hope. What ended it was a diagnosis, not a better version: measuring what each live fill was actually worth. The price moved against us after nearly every fill, by more than the rebate paid, and the damage didn’t shrink no matter how long or briefly our quotes rested. That killed the comfortable story that speed would fix it; our fills were the ones informed flow wanted us to have. So we killed the class instead of shipping version eight. At our fee tier and scale, on those symbols, the spread belonged to someone else. That sentence cost months of engineering and real trading losses to earn. It costs nothing to obey.
That is what the three deaths look like from the inside, at survivable scale: a cascade that stayed small enough to fix, a counterparty lesson that cost patience instead of principal, a strategy killed by data instead of drawdown. The goal isn’t avoiding entries in the ledger. It’s making sure every entry is small enough to learn from.
Until recently, the uncomfortable arithmetic was time. A realistic build covers market data and connectivity across venues, an execution layer, a risk engine with real limits, validation infrastructure, monitoring and incident response, and the reconciliation underneath all of it; Building a Trading Engine That Can Survive and Adapt walks a single order through it. From scratch, that took 12 to 24 months by a team you had to hire first, and those months of burn with nothing live were the largest cost a new desk never budgeted.
AI coding agents have collapsed the time from a blank repository to a first live order, from 12 to 24 months to weeks. They have not collapsed the time required to understand, verify, and trust the system when money is moving. We use agents throughout the build and operating loop, but people retain the gates wherever capital moves. The cost moved rather than disappeared, and each place it moved to is one of the three deaths, running faster:
So the scarce thing is no longer the build; it’s verification. Tests that encode what venues actually do rather than what the documentation says, reconciliation that runs independently of the code that moves money, limits no generated code can override, and people who understand the system well enough to stop it. Time to live used to be the line item that never appeared in the budget. Now it’s time to understand.
That’s the trap: the pillars that keep you alive are exactly the ones that feel optional when you’re racing to deploy, and the race now takes weeks. Firms cut them to get live faster, and then join one of the three graveyards above.
If you allocate capital: the diagnostic is short. Ask a manager how they’d survive each death. What stops a runaway algorithm, has it ever fired, and who can explain the code when it does? What happens to the book if their largest venue freezes withdrawals tomorrow? How many uncorrelated edges are they running, and when did they last kill one? A manager with real answers has a durable operation. A manager who talks only about their signal is showing you the go-kart frame. If you’re evaluating crypto-native quant exposure, that’s the conversation we’re set up to have.
If you’re standing up a desk: the same three questions apply to your own build, on day one. If the honest answer is that operations, risk, and validation are “phase two,” that’s the gap to close before the first incident, not after: build it, hire it, or partner for it. Agents make building it the fast option, not the safe one. How matters less than when.
Either way: we’re writing this series from a live book, not a whiteboard. Which of the three deaths is your operation least covered against: minutes, months, or years? If you want to compare notes, start a conversation.
Martian Mobile is a proprietary crypto trading firm operating since 2018. More from the series on survivability, trading operations, and validating edges: Insights.