On 6 April 2018, an employee at Samsung Securities, one of South Korea's largest brokerages, set out to run a routine dividend for the company's employee stock ownership plan: 1,000 won per share, about ninety American cents, owed on roughly 2.8 million shares held by 2,018 colleagues. The intended payout came to about 2.81 billion won, call it $2.6 million.
In the entry field, the employee typed 1,000 shares per share.
The system accepted it. Into those 2,018 accounts it credited 2,812,956,000 shares of Samsung Securities, worth 112 trillion won at the day's price, about $105 billion at 2018 exchange rates. Same numeral the dividend clerk intended. Different unit. The company had roughly 89 million shares outstanding, so the system had just conjured, from a keystroke, about 31.6 times the entire company, stock that did not exist, had never been authorized, and exceeded the issuance ceiling written into Samsung Securities' own articles of incorporation.
Then sixteen employees looked at their suddenly nine-figure account balances and started selling.
What happened next is the part every engineer should study frame by frame. The phantom shares were sellable, and sold: about 5.01 million of them went to market before the firm stopped it, which at the day's price works out to roughly $186 million, a figure worth labeling honestly as arithmetic on the verified share count rather than a number any regulator published. The stock fell as much as 11.7 percent intraday as the sell orders hit. The company reportedly stopped the bleeding about 37 minutes after becoming aware of it, and by the close, the episode had destroyed on the order of $428 million of Samsung Securities' real market value, none of which had anything to do with the company's actual business.
And one detail elevates those sixteen sellers from a morality tale into a systems lesson: reporting at the time said managers repeatedly warned employees not to sell the shares, and sixteen did anyway. Hold onto that. The instruction existed. It simply had no enforcement behind it, which makes it a control of exactly the same species as the one whose absence created the shares in the first place: a rule that lived in words rather than in code. The only mechanism that responded at machine speed that morning was the market itself, greed and its consequences becoming visible on the tape within the hour. Everything else fired in months, or years.
Before the systems argument, one piece of arithmetic that the coverage never quite states, even though every number needed for it was published. The intended transfer was 2.81 billion won. The actual credit was 2.81 billion shares. The ratio between the value of what was meant and the value of what happened is exactly one share price, 39,816 won, which is where Samsung Securities traded that spring; the published figures reconstruct to it precisely.
That is the general law hiding in this incident, and it is not a metaphor. When a field can confuse currency units with instrument units, the error is multiplied by the market price of the instrument. A won-for-shares confusion at a penny-stock registrar is an embarrassing rounding error; the same keystroke at a brokerage whose stock trades at 40,000 won is a hundred-billion-dollar event. No amount of double-checking discipline at the input field changes that multiplier, because the multiplier is a property of the domain, not of the operator. The care you invest in the field scales linearly; the damage scales with price. Which is the first argument that the real defense was never a better input check at all.
Korea's Financial Supervisory Service went in, and its published findings are a familiar litany. The firm had a "lack of a monitoring system and contingency plan." It "failed to immediately suspend sales" once the ghost shares landed. And one detail that deserves a spotlight: the brokerage had updated the relevant computer system that January, three months before the incident, "but did not conduct a test drive to uncover possible errors." The courts, in the civil litigation that followed, found the firm negligent for failing to build an adequate dividend system and to properly establish internal controls and risk management standards.
All true, all documented, and all of it stops one question short. Nothing in the public record explains why the system was able to create shares that did not exist. The IEEE Spectrum write-up that April relayed the regulator's own astonishment, asking how two billion nonexistent shares "managed to get allocated" and how they "could even be legally sold," and no published finding since has answered in mechanism-level terms.
So here is the teardown's argument, offered explicitly as a reconstruction rather than as anyone's official finding, because no regulator or court said it in these words. It is the one explanation that fits every published fact at once.
Think about what checks a dividend-crediting path plausibly runs per account: is this a valid employee, is this a valid instrument, is the number well-formed, does the batch balance against its own inputs. Every one of those checks can pass on the ghost dividend, because per account, nothing is wrong: real employee, real ticker, a number in a numeric field. The check that fails is not per-account at all. It is the invariant that defines what a share registry is: the sum of credited shares of an instrument cannot exceed the shares issued. Samsung Securities had about 89 million shares outstanding, a hard ceiling written into its corporate charter, and the credit that went through breached that ceiling thirty-one times over. Which tells you, as close to conclusively as the public record allows, that nothing anywhere in the crediting path compared the credit against issuance. The deepest fact about the system, the conservation law of a share ledger, lived in everyone's head and in a legal document, and in no line of the code that moved the shares.
And the January detail completes it. The code where that invariant should have lived had just been changed, three months earlier, by an organization that did not test the change. A conservation law that exists only as an assumption survives every change that honors it and detects none that don't.
If the essay's earlier law was "a unit error scales by the price of the instrument," the second is its partner: input validation is linear defense, invariants are structural defense. The first inspects what operators type. The second constrains what the system can do, whatever gets typed. Samsung Securities had, on the evidence, only the first kind, plus a manager's verbal warning where the second kind should have been, twice.
What did the failure cost the people responsible for the system, as opposed to its shareholders? The Financial Services Commission fined the firm 144 million won, about $129,000, and barred its brokerage business from taking new clients for six months. The CEO, Koo Sung-hoon, was ordered suspended for three months and resigned that July. Set the fine beside the event and let it sit: $129,000, for a system that minted $105 billion of nonexistent stock and vaporized $428 million of its own shareholders' value in an afternoon. The penalty was three ten-thousandths of the self-inflicted loss. Whatever deterred anything here, it was not the fine; the market's same-day verdict was three thousand times larger.
Then, five days before this essay was written, the story got its final chapter. On 12 August 2026, Korea's Supreme Court ruled on the claim brought by the National Pension Service, the country's largest institutional investor, which had sold its Samsung Securities stake into the chaos. The court found a "strong" likelihood of a causal relationship between the employees' negligence and the fund's losses, limited the firm's liability to 50 percent, and awarded 1.86 billion won, about $1.3 million. The fund had sought 29.9 billion won; it recovered roughly six percent of its claim, eight years and four months after the trade date.
Line the control mechanisms up by response time, because the ordering is the lesson. The tape repriced the failure within the hour. The regulator arrived in three months with a $129,000 invoice. The final court ruling arrived in the ninth year, for six cents on the claimed won. Real-time systems get exactly one layer of defense that operates at the speed of the failure, and it is the one compiled into the transaction path. Everything downstream of that is not a control. It is historiography with a payment schedule.
Four tests, each cheap against the number in this essay's title.
Name your registry invariant. Every system of record has a conservation law that defines it: credited shares cannot exceed issued shares, ledger debits equal credits, inventory shipped cannot exceed inventory received, tokens redeemed cannot exceed tokens minted. Write yours down in one sentence. If your team cannot, that is the finding.
Enforce it at the write, not at the keyboard. Input validation on the field would not have saved Samsung Securities from a well-formed number in the wrong unit; a constraint at the crediting write, sum of credits against issuance, catches every path to the violation, including the paths not yet enumerated. The invariant belongs where the state changes.
Type your units. A field that can mean won or shares depending on context is a loaded instrument, and the safety is a type system, machine-level or schema-level, that makes currency and quantity uncombinable. The same numeral in a different unit was the entire event.
And audit for controls that are actually wishes. The managers' warning not to sell was a control with no mechanism; so was the invariant that lived in the corporate charter but not the code. Most engineering organizations carry the same inventory without noticing: the deploy freeze that is an announcement rather than a locked pipeline, the "always get review before merging to main" convention with force-push enabled, the spending cap that is a dashboard someone checks weekly rather than a limit the account enforces, the runbook step that says "verify with the on-call before deleting" in a procedure a script executes unattended. Each is an instruction wearing a control's clothing, and each works right up until the first person, or the first automated process, that does not stop to read it. Walk your critical paths and ask of each safeguard: does this exist as enforcement, or as an expectation that everyone will keep behaving? Samsung Securities is what the second kind looks like on the day someone doesn't, and the one mercy of the case is that the whole lesson is now available to everyone else at a discount: the fine was $129,000, the tuition was $105 billion, and the reading takes ten minutes.
Sources: figures per contemporaneous and follow-up reporting, cross-checked arithmetically (the published counts reconstruct to the 2018 share price of ~39,816 won): 2,812,956,000 shares credited to 2,018 ESOP accounts against ~89 million outstanding; 112 trillion won notional (~$105B at 2018 rates, conversion date-dependent); 5.01 million shares sold by 16 employees (≈$186M by computation, not a reported figure); intraday fall up to 11.7%; ~$428M market value lost. Korea Times, "'Lousy' system caused fat finger scandal at Samsung Securities" (8 May 2018) for the FSS findings including the untested January system update; Robert N. Charette, IEEE Spectrum Risk Factor (13 April 2018); FSC penalties and the CEO's July 2018 resignation per Bloomberg/Business Standard reporting; Supreme Court ruling of 12 August 2026 per Yonhap/Korea Times (1.86 billion won to the National Pension Service at 50% liability against a 29.9 billion won claim). The structural claim about the missing registry invariant is this essay's reconstruction from the published facts, including the breach of the issuance limit in the company's articles of incorporation, and is labeled as such.
Walk your own critical paths and ask which safeguards are enforcement and which are expectations. For agent systems the question is sharper, because an agent does not stop to read a convention: the spending cap, the review-before-merge rule, the "check with the on-call first" step are all instructions wearing a control's clothing unless something in the path refuses. The Agent Trust Stack is the enforcement-and-record half of that problem, so a constraint lives where the state changes rather than in a document.
pip install agent-trust-stack
npm install agent-trust-stack