The Short Version

Sailors Were Right

For centuries, sailors came back to port with stories about impossible waves—walls of water that rose out of nowhere, twice the height of the seas around them. Oceanographers dismissed them. The models were clear: waves are independent swells, random heights, random timing. Add them up and the math says a 25-meter wave is so rare it might as well be impossible.

On New Year’s Day 1995, a laser on a Norwegian oil platform measured one. 25.6 meters. The seas were running at twelve.

The models didn’t have the wrong data. They had the wrong assumption. Wave trains from different storms came together at the same point and their heights didn’t average out. They concentrated. The parts of the system weren’t independent, and the models that said they were got the probability catastrophically wrong.

This book is about the same assumption, failing the same way, in everything from power grids to stock markets to hospitals.

The sailors were right. The math was wrong. It took an instrument to settle the argument.

February 15, 2021

4.5 million homes and businesses dark. Single-digit temperatures. The power grid is eating its own tail: the gas plants need electricity to run the compressors that push gas to the gas plants.

Water treatment fails. Hospitals run on backup generators sized for hours, not days. The cold doesn’t break for a week.

246 dead. $195 billion in damage.

Every review asked the same question: why was nobody prepared?

The grid operators had models. The models said this was too rare to prepare for. Winterizing the grid would have cost maybe $10 billion. The models said the expected annual loss was about $39,000, so the investment looked insane.

The models were wrong by a factor of 100,000.

Not because they had the wrong temperatures. Not because they used the wrong time period. Because they assumed that when Dallas is freezing, whether Houston is also freezing is a coin flip. It isn’t. Cold fronts are big.

Guess the Number

Here’s a game.

Eight Texas cities. Thirty winters of daily temperatures. Define “cold” as a day when a city hits its own worst 10%. Question: how often are at least half the cities simultaneously cold for a full week?

Now imagine you shuffled the calendar. Every city keeps its exact same temperatures, but the days they fall on are scrambled. This is what independence looks like: same weather per city, no connection between cities.

In the shuffled world, that kind of week happens about once every 90 million winters.

In reality, it happened three times in thirty years.

The formal permutation test—which counts total event-days rather than event-occurrences—puts the ratio at:

About twelve million.

Once in 10³⁴ Winters

February 2021. Six of eight Texas cities in their worst 5% simultaneously, for eight straight days.

A model that knows the seasons but assumes the cities are independent predicts this happens once every 10³⁴ winters.

For scale: the universe is about 10¹⁰ years old.

It happened once in 74 years.

The Trap

Ask a gentle question—“How often is any city unusually cold?”—and the independence model is slightly conservative. It overestimates. A practitioner who checks the model with this question walks away satisfied.

Ask a severe question—“How often are half the cities in their coldest tenth for a full week?”—and the same model, on the same data, is wrong by twelve million.

Guess which question people use to test their models.

The Whole Law

R is how wrong the independence model is. d is how dependent your system actually is. n is how bad a question you’re asking.

When n is small—“what’s the average?”—R is close to 1. The model works.

When n is large—“how often do five things fail together for a week?”—R is enormous. The model is catastrophically wrong.

Twenty-nine datasets across weather, finance, epidemics, agriculture, crypto, traffic, energy, housing, commodities, seismology, and chess. Same law, same shape, different d.

That’s it. That’s the whole thing. Everything else is details.

The Dog That Didn’t Bark

Earthquakes. Twelve seismically active regions, five continents, 27 years of data.

The ratio: between 0.98 and 1.02. Indistinguishable from 1.

Different plate boundaries are driven by different geological stresses, separated by thousands of kilometers. There is no shared atmosphere. No shared economy. No shared supply chain. The physics says independence.

Same test. Same code. Same math. Where there’s no shared cause, the model is exactly right.

That’s what makes the twelve million in Texas credible. The test doesn’t hallucinate dependence. It finds zero where there should be zero and twelve million where eight cities share an atmosphere.

NFL Games Are Independent

NFL games played on the same Sunday: R between 0.98 and 1.07.

Different teams, different cities, different matchups. No shared cause. The independence model nails it.

MLB games: same.

The test gives the right answer when the answer is boring.

The COVID Number

Ten US states, daily case counts, March 2020 to December 2022. An event: a state’s seven-day average above its own 75th percentile.

Under independence, a simultaneous multi-state surge persisting five days should essentially never happen. In 200 shuffled trials, it didn’t happen once.

In the real data, it did. The ratio: about 10,000×.

The decomposition says where it comes from. Persistence (each state’s wave lasted weeks): 69×. Spatial coupling (states surged together): 145×. Exact co-timing: only 3.7×—the waves overlapped heavily even when their timing was scrambled.

The hospital surge models assumed regions peak independently. When they all peaked together, there weren’t enough beds, nurses, or ventilators anywhere nearby—because “nearby” was also in surge.

The Three Pieces

The total error breaks into exactly three pieces. Not approximately. Exactly.

Persistence. Cold follows cold. Floods persist. Surges build over weeks.

Synchronization. When Dallas is cold, Houston is cold. When tech crashes, financials crash too.

Total. Persistence times synchronization. Always.

For weather, both are large. For stock markets, synchronization dominates: crashes are short but everything crashes at once. For epidemics, persistence dominates: waves last months, but regions peak at different times.

The mix tells you what kind of dependence you have—and which fix will actually help.

The 2008 Crisis in 100 Words

Banks bundled mortgages into packages, sliced them by risk, and sold the slices. The model said the safe slices could lose money only if a huge number of mortgages defaulted simultaneously. The model used a formula called the Gaussian copula. The copula assumed low tail dependence.

The mortgages shared one common factor: the housing market.

When housing fell, they all defaulted together. The “safe” slices lost everything.

d was high. n was high. Nobody had measured dⁿ.

Why Copulas Don’t Fix It

After 2008, the standard fix was fancier copulas—better models of how things move together.

A copula fixes the synchronization piece. It doesn’t touch the persistence piece.

For Texas weather, persistence alone is a factor of 650. A perfect copula—one that gets every pairwise correlation exactly right—leaves 650 sitting there.

For stock markets, where synchronization is the main event, copulas help. For epidemics and infrastructure, where persistence dominates, they barely move the needle.

The repair fixes one factor of a product and leaves the other.

Your Index Fund Is a Synchronization Machine

When money flows into an S&P 500 index fund, the fund buys all 500 stocks in proportion. Apple. ExxonMobil. A hospital chain. A semiconductor maker. Same dollar, same day, same direction.

Apple’s earnings report has nothing to do with ExxonMobil’s drilling permits. The index fund doesn’t care. It buys them together.

Index-fund ownership of the S&P went from roughly 15% to about 40% over the same period. As it rises, prices synchronize. As prices synchronize, d rises. As d rises, dⁿ grows exponentially.

The fund’s job is to track the index. The side effect is to synchronize crashes. Nobody’s doing anything wrong. The mechanism is the design.

The Charge-Discharge Cycle

During calm markets, leverage rises, correlations drop, and the independence model looks great. Risk managers gain confidence. Positions grow. Everyone appears diversified.

Then something breaks. Correlations snap to one. Leverage unwinds. Fire sales force everyone to sell the same things at the same time. The pricing error that was building invisibly for years discharges all at once.

This isn’t theory. In the data, the peak ratio before each crash correlates with how bad the crash is. Higher charge, harder discharge.

The three equity cycles since 2000 all show it. The longest calm was the mid-2010s. It ended in March 2020.

As of October 2026, the ratio is R ≈ 2.9. Moderate. Early in the charge phase.

The thermometer reads cool. It will not stay cool.

The Cure Is One Number on a Screen

R does not appear in any dashboard, any risk model, any regulatory filing, or any performance review.

The pricing error is invisible. That’s why the cycle keeps repeating.

If investors could see R = 12, they’d know their “diversified” portfolio is a synchronized bet. They’d hedge. If regulators could see R climbing, they could raise capital requirements before the crash, not after.

The Swiss alpine villages that Elinor Ostrom studied—some with grazing rules centuries old—survived because every villager could see the state of the shared pasture. The villages that collapsed couldn’t.

R is the financial equivalent of being able to see the commons. The cure isn’t a new regulation. It’s a number on a screen that won’t go away.

How Crypto Actually Prices Risk

The formula that decides whether your DeFi loan gets liquidated:

health = (collateral × avg threshold) / debt

The “average threshold” is a dollar-weighted average of per-asset numbers. ETH gets 85%. LINK gets 70%. Post both, you get 77.5%.

There is no correlation term. No joint-tail model. Nothing that accounts for ETH and LINK crashing at the same time.

The people who set the parameters use models that do capture correlation. They know. But their analysis produces one number per asset. The number goes into a formula that can’t express dependence.

The knowledge is off-chain. The code is independent.

d = 3.31

Eight crypto assets. 2,212 days. Same test as Texas.

Crypto: d = 3.31. Equities over the same period: d = 2.44.

What that means in practice: at n = 7 (four assets in simultaneous distress for four days), the independence model underprices crypto risk by 4,400 times. Equities: 520 times. At n = 11, crypto is wrong by 523,000 times.

Three reasons DeFi is worse. One shared ledger that every protocol reads and writes. Designed-in composability—“money legos”—that adds layers to the exponent. And block-speed propagation: liquidation cascades in twelve seconds, not twelve weeks.

Higher d. Higher n. Faster.

This was tested directly against Aave’s design. Aave publishes a maximum loan-to-value ratio and a liquidation threshold for each collateral asset. Taking those exact numbers and applying them to the daily price data asks: how often would positions at maximum leverage across multiple assets trigger liquidation on the same day?

At four assets: 301 times more often than the per-asset model predicts. At five: 6,889 times. At six or more: the independent model predicts zero co-liquidation days in 2,000 shuffles. The data has 21. Every one of the 36 pairwise asset combinations is significant at p < 0.001. Not one pair behaves independently.

Fifteen audit firms have reviewed Aave across its versions. None flagged this. They verified that the code correctly implements per-asset thresholds. Gauntlet and Chaos Labs were tasked specifically with risk analysis and did not report on correlation between assets either. The per-asset thresholds don’t account for it, and nobody tested for it.

The test script is public: test_aave_liquidation_clustering.py. It requires only Python, numpy, and yfinance (all free). No API key. No on-chain data. Run it yourself in thirty seconds.

The Quiet Part

On Aave’s own governance forum, after a $124–230 million loss in April 2026:

The parameters are set for revenue. The people inside the system say so on a public forum.

This is the CDO parallel. Not as metaphor.

The AI Version of This Problem

AI benchmarks test models on individual tasks and report individual scores. Coding: 90%. Reasoning: 85%. Factual recall: 80%.

Here’s the question nobody asks: when it fails at coding, does it also fail at reasoning?

If the failures are independent, the chance of failing at all three is 0.3%.

If they’re correlated—same model, same training data, same architectural bottlenecks—the true rate could be orders of magnitude higher.

The deployment monoculture makes it worse. Millions of users, same model, same provider. A single failure mode hits everyone at once.

The permutation test exists. The benchmark data exists. The computation would take minutes. Nobody has run it.

Why Nobody Fixes It

Four forces keep the independence assumption alive.

Your brain. Humans decompose compound probabilities by estimating each part and multiplying. That gives the right answer only if the parts are independent.

The org chart. The fire actuary doesn’t talk to the flood actuary. The weather team doesn’t talk to the grid team. Nobody owns the joint.

The budget. The independent model needs n numbers. The full joint needs 2ⁿ. Independence is exponentially cheaper. It also looks right most of the time, because compound disasters are rare between compound disasters.

The curriculum. Fisher designed experiments so that observations would be independent. Ninety-one years of statistics is built on that foundation.

After every disaster, reform targets one of these forces. The other three hold. Within a decade, the assumption has reasserted itself.

Fukushima

Before the disaster, Japanese nuclear regulators assessed earthquake hazard and tsunami hazard through separate probabilistic risk assessments.

The earthquake that cut off-site power and the tsunami that overtopped the seawall and flooded the backup generators were never assessed as a joint probability—because each hazard belonged to a different analytical team.

Nobody’s job was to compute dⁿ.

The Wealth Buffer Is Being Removed

DeFi’s compound coupling hasn’t caused macroeconomic damage yet. Terra/Luna wiped out $40 billion, Three Arrows Capital $30 billion, FTX $30 billion. None spilled into the real economy.

Why? DeFi participants are mostly speculators. Their losses don’t reach payroll, pensions, or sovereign balance sheets.

That structural accident is being actively removed. BlackRock and Fidelity are building infrastructure to connect pension allocations to DeFi yield. Tokenized real-world assets are bridging DeFi to traditional asset pools.

The dependence didn’t change. The buffer did.

Separate Chains Are Not Separate

You might think different blockchains provide diversification. Ethereum, Solana, Avalanche, Polygon—separate validators, separate code, separate ecosystems. The intuition says a crash on one shouldn’t drag down the others.

A permutation test across ten chains shows the same pattern. At mild severity the coupling is moderate—d around 1.7. But as you raise the question to half the chains in simultaneous distress, the ratio hits 500× and d reaches 3.47—comparable to within-Ethereum crypto. At higher severity still, the shuffled data produces zero events. The real data doesn’t.

The lead-lag test found zero days of warning at daily resolution. Every chain crashes on the same calendar day as Ethereum. Correlation with Ethereum: 0.49 to 0.73 for each chain. No chain goes first.

The TVL test measures actual capital, not prices. When capital flees one chain, it flees all of them. At four of eight chains losing TVL simultaneously for two days: wrong by 636×. The coupling ranges from moderate at mild severity (d ≈ 1.4) to extreme at high severity (d ≈ 3.6). This isn’t prices co-moving. This is money leaving.

Three channels. Shared collateral: ETH and BTC are posted as collateral on every chain, and oracle feeds pull from the same Ethereum-based markets. Shared liquidity providers: the same market makers operate everywhere, and when they get liquidated on one chain they pull liquidity from all others to cover. Bridge tokens: wrapped assets connect the chains, so a depeg on one side propagates instantly.

This is the cascade path. A crash on Ethereum reprices collateral everywhere simultaneously. Liquidations fire on every chain in the same block window. Market makers drain liquidity from all chains to cover. TVL collapses across the entire ecosystem—not sequentially, simultaneously. Any tokenized real-world assets sitting as collateral—Treasuries, corporate bonds, BlackRock’s BUIDL fund—get liquidated at block speed alongside everything else.

The April 2026 rsETH exploit was one protocol, one token, one chain—not a correlated crash, just a bridge hack. It still caused $124–230 million in bad debt and $8.45 billion in TVL flight—about a third of Aave’s deposits, gone in 48 hours. A correlated crash across all chains, where the independence model is wrong by 500× or more, hits harder and everywhere at once.

The “diversification” of being on multiple chains is the same illusion as the “diversification” of holding multiple CDO tranches in 2008.

The Sign Flip

Dependence doesn’t always make things worse.

For streak costs—how often do bad things persist?—the error is huge. Independence underestimates.

For switching costs—how often do things alternate?—independence overestimates.

Same data. Same dependence. The direction of the error depends entirely on what you’re counting.

A practitioner who tests the model with a switching question—and many do, because switching is what normal operations look like—will conclude independence is conservative. They will never discover it is wrong by twelve million for the streak question that determines whether the grid collapses.

Forty Lines

The test to measure all of this is forty lines of code.

Load a matrix of time series. Define “event” as each series hitting its own worst percentile. Count how many days have M or more series in event for K or more consecutive days. Shuffle each column independently. Count again. Repeat a thousand times. Divide.

That ratio is how wrong the independence assumption is, at the severity you picked. Run it at multiple severities and watch it grow exponentially. The slope tells you d.

It works on weather stations, stock returns, hospital admissions, server outages, sensor networks—anything with multiple time series that might be dependent.

The code runs in under two minutes. The data already exists. The test has been available since 1935.

It went unrun for ninety-one years.

The Key Numbers