It was like watching a game of poker between players wearing masks.Cramer had been right. Overloaded with information, the exchange system had broken down. Quotes on General Electric shares experienced a 24-second delay at one point and other stocks hit 36 seconds, yet no one appeared to have noticed – or, if they had, they weren't saying. As Hunsader pulled his focus back, he saw something even more surprising: patterns, often repeating over hours or days or weeks, clearly aiming at stealth. Here were machines placing and cancelling the same order 10,000 times in a second, or stepping from one share all the way to 100, one at a time, and then marching back down again in milliseconds, over and over and over.The Nanex software rendered these anomalies as shapes, so Hunsader and Donovan took to calling them crop circles, and even gave them names: Wild Thing, Zuma, The Click, Living On The Edge. The pair quickly realised that many were designed not just to manipulate the system, but to avoid detection by each other, even to lure slower algos into traps. Was it possible that the Flash Crash had been caused on purpose, by "stuffing" the New York Stock Exchange with messages in order to slow it down and create fleeting price discrepancies, upon which the fastest machines could pounce? When Waddell & Reed took the highly unusual step of asking Hunsader to examine their algorithm and its actions on 6 May, he quickly saw that it could never have caused the Flash Crash. The truth lay elsewhere.

Hunsader watched and blogged what he saw as anomalies. A major HFT firm called Knight Capital, the largest stock trader in the US, imploded when a test algo was mistakenly used for live trades, buying and selling 2.6m shares per second in an electronic fit lasting 45 minutes and costing $440m. On another occasion, a mysterious "ghost algo" appeared out of nowhere, placing and cancelling orders in 25-millisecond furies up to 10.30am each morning for a week, accounting for 4% of traffic on the US stock market without executing a single trade – then vanishing. A hoax tweet claiming that President Obama had been injured in twin explosions at the White House caused another terrifying slide, which became known as the Hash Crash – because the machines were now reading Twitter. By the end of 2013, Hunsader counted an average of two dozen "mini-flash crashes" in individual stocks every day.

The numbers were now mind-boggling. In the 1960s, an average share in a company would be held for four years, a figure that had fallen to eight months by 2000, en route to two months in 2008. But now the average share was held for 20 seconds, with 10 on the horizon and the fastest machines able to fetch quotes in a millionth of a second. Within two years of the Flash Crash, HFT accounted for 70% of market activity in the US and almost 40% in Europe. Meanwhile, more than 50 so-called "dark pool" markets had risen to shelter slower traders behind anonymity, but most of these had been colonised by predator algos, with some deteriorating into "toxic dark pools", where no one was safe. Algo-designing quants now earned hundreds of thousands, even millions a year and NxCore was processing a trillion bytes of information per day. The faster the machines got, the less anyone could tell what was really going on.

The lawyer Michael Lewis's first thought was to build a case for market manipulation and insider trading against the HFT firms. But the more he spoke to Hunsader, the more he began to accept that this would be too complicated for judges to follow. Instead, Hunsader nudged Lewis in the direction of the two most serious advantages HFT traders had been handed by exchanges: the faster language or secret order types, and the private data feeds. US stock exchanges promise to supply subscribers with timely and accurate information via their standard SIP feed, for which users pay a total of $500m a year. It appeared to Lewis that the exchanges were in breach of that contract. "The information they were providing was not timely or accurate, and wasn't fairly distributed. Here's what's happening: the real market is represented by these private data feeds. The illusory market, the market that the investor sees when he looks at his monitor, is anywhere from 1,500 to 900 milliseconds old. That doesn't sound like much, because the blink of an eye is 300ms. But that's a long, long time in the world of HFT."