Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

Popping S(h)ells - Hunting for Vulns in the Stock Market

Eric Bryce

PolicyTalks53 minBeginnerOpen on YouTube ↗

Where

Talks
HOPE XV

Duration

53 min

Explains how stock exchange design assumptions create exploitable gaps, and walks through SEC-prosecuted market manipulation cases.

Summary

Eric Bryce, who works in algorithmic trading, opens by framing the talk as an introduction to how market manipulation works and why it tends to get caught. He notes that enforcement records are unusually rich, and that many cases surface years after the conduct, once regulators have the full trade data.

The middle of the talk covers mechanics. He walks through limit order books, the FIX messaging format used to send orders, and why latency between the New Jersey data centers matters, including why microwave links can beat fiber. He then explains adverse selection and how a large resting bid or offer can signal false intent. Spoofing and layering are the main examples, including a metals trading desk case prosecuted years after the conduct. He also covers dark pool midpoint pricing abused with fake quotes, rigging of the LIBOR benchmark through coordinated submissions, and cornering futures markets such as silver and orange juice.

He closes by stressing that the data retained by exchanges makes detection likely, since a losing counterparty often reviews the tape and reports suspicious orders. Questions covered whistleblower incentives, leveraged options in insider cases, and cross-asset manipulation. The practical takeaway is that understanding how exchanges are built helps explain both how schemes work and how they are found.

Related talks

Talks·43 min

  • hack.lu
  • Policy
  • Date: Oct 2025
  • Location: Luxembourg

Trey Darley · Pedro Umbelino

Maps how the 2038 Unix time rollover threatens systems worldwide and why coordinated remediation is so hard.

riskinfrastructurevulnerabilities+2