Crashes in leveraged markets are not just prices falling. They are machines running. A price falls, a liquidation engine sells, the selling moves the price, which trips more liquidations, and the loop runs until it hits something. Brunnermeier and Pedersen (2009) gave this a theory; crypto gave it automation. If you're going to build anything with leverage in it, you need to be able to compute the loop before you launch, not watch it afterwards.

Two liquidities

Market liquidity is how cheaply you can trade: spread, depth, price impact. Lesson 2.
Funding liquidity is how easily traders can finance their positions: margin requirements, haircuts, the availability of borrowing.

The insight is that they depend on each other. Market makers and arbitrageurs provide market liquidity, but they do it with borrowed money, so their ability to quote depends on funding liquidity. When funding tightens, they quote less, market liquidity falls, prices become more volatile, and lenders tighten funding further. Two spirals follow.

Loss spiral. Prices fall; leveraged holders lose equity; they must sell to meet margin; the selling pushes prices down further; repeat.
Margin spiral. Volatility rises; lenders and exchanges raise margin requirements and haircuts; everyone has to deleverage at the same time, into a market where liquidity has just disappeared.

The two run together: the loss spiral generates the volatility that triggers the margin spiral.

A cascade you can compute

Here is the loss spiral as arithmetic. The point is not the specific numbers; it's that the multiplier is a formula you can evaluate for your own market.

A 15% shock in a $1B market

Open interest is $1B of leveraged longs. Their liquidation prices are spread evenly between 5% and 30% below the current price, so each 1% of further decline liquidates $40M. Selling $100M of this asset moves its price down 1% (that's the market's depth, Kyle's λ from lesson 2). News hits and the price falls 15%.

Round 1	−15% liquidates positions between −5% and −15%: 10 × $40M	$400M sold → price another −4%
Round 2	−4% more liquidates 4 × $40M	$160M sold → −1.6%
Round 3	1.6 × $40M	$64M → −0.64%
…each round is 0.4× the last	total extra decline = 4% / (1 − 0.4)	−6.7%
Final	−15% − 6.7%	−21.7%, with about $667M liquidated

The 0.4 is the product of two numbers: how much gets liquidated per 1% of decline ($40M) and how much each dollar of selling moves the price (1% per $100M). Call their product r. The shock is amplified by 1/(1 − r). At r = 0.4 the amplifier is 1.67×. At r = 0.8 it's 5×. At r = 1 the market does not find a bottom until positions run out. Two things push r up on a bad day: depth evaporates (impact per dollar rises) and liquidation prices cluster (more OI per 1%). Both happened on October 10.

amplification ≈ 1 / (1 − r), r = (OI liquidated per 1% move) × (price impact per $ sold)

Both terms change during the crash. Measure them on your worst historical day, not your average one.

Cumulative decline after each round of forced selling in the worked example. The shock was 15%; the machine added 6.7 points on its own.

The crypto version

Traditional markets run the loss spiral through margin desks, phone calls and a day or two of delay. Crypto runs it through liquidation engines that fire within a block, on venues that are open 24 hours, with collateral that is itself a leveraged token. There is no circuit breaker unless someone designed one.

October 10, 2025

On a Friday afternoon US time, a tariff headline hit a market that had spent weeks building long leverage. Roughly $19B of positions were liquidated within about 24 hours, the largest day on record by a wide margin. Reports put Hyperliquid's share at about $10B, and its auto-deleveraging mechanism ran for the first time in more than two years, closing profitable shorts against bankrupt longs because the order book could not absorb them. On Binance, USDe briefly traded far below $1 (reports cite around $0.65) because Binance priced collateral from its own thin spot book rather than a broad index. Positions using USDe as margin were liquidated at that price even though USDe held near par on deeper venues. Then those liquidations added to the selling. One venue's oracle choice became everyone's cascade.

Read that paragraph against the formula. Depth vanished (impact per dollar up). Liquidation prices were clustered because a crowded long trade had been put on at similar levels (OI per 1% up). And a collateral-pricing choice created an extra, venue-specific spiral on top. r went above one for a while.

What a protocol designer actually controls

You can't control the shock. You can control r and what happens when the spiral reaches your balance sheet.

Margin that rises before volatility, not during it. Tiered maintenance margin by position size, leverage caps per asset tied to depth, and requirements that step up with open interest rather than with realised volatility (by the time realised vol is high, raising margin is the margin spiral).
Oracle choice. Which price triggers liquidations? A broad index of deep venues, with a mark price that resists one bad print (Unit 9). Never your own thin book, and never a single exchange's spot.
Liquidation pacing. Partial liquidations (close 50% and re-check), Dutch auctions that start the discount low, and backstop vaults that take positions off the book instead of dumping them into it. Each one lowers impact per dollar liquidated.
The loss-absorption order. Trader's margin, then the insurance fund, then a backstop LP, then auto-deleveraging or socialised loss. Write it down, size each layer, and publish it. The argument about who pays is far more expensive during the event.
Withdrawal design for your own LPs. If your protocol has a vault that backstops liquidations, that vault's depositors can run too. Queues, utilisation caps and cooldowns are your protocol's own funding liquidity.

A rule and a test

The rule: caps follow liquidity, not demand. Demand for leverage is highest exactly when the next cascade is being loaded. The test: take the worst day in your asset's history (or October 10, 2025), measure the depth that was actually there, apply it to the open interest you're willing to allow, and run the arithmetic above. If r comes out near one, your parameters are a cascade waiting for a headline. The simulator below lets you turn the knobs.