The Most Expensive Human Errors in History, Ranked

Written by James Taylor
When Safeguards Failed: The Decisions Behind History’s Biggest Losses

The Cost of Looking Away

The Price of One Wrong Decision

From a spacecraft lost near Mars to a crisis that damaged entire economies, eight costly failures reveal how mistakes escape the systems meant to contain them.

In August 2012, a trading firm turned 212 customer orders into a financial emergency. Its automated system generated millions of transactions, leaving Knight Capital with unwanted positions and an eventual loss exceeding $460 million. The malfunction ran for roughly 45 minutes. The weaknesses that allowed it to happen had existed much longer.

That distinction runs through the most expensive human errors in history. A wrong measurement, a concealed trading loss or a misread safety test can start the damage. The largest catastrophes happen when the surrounding organisation fails to interrupt it.

The 2007–09 financial crisis takes first place in this selection because estimates of lost American output alone reach trillions of dollars. Nuclear disasters follow on a different, less directly comparable basis: decades of remediation, displacement and wider economic damage. Neither can honestly be described as one person pressing the wrong button.

What This Ranking Actually Measures

This is a countdown of eight well-documented, costly human failures, ordered by the scale of the stated financial benchmark. It is not an exhaustive world record or a precise inflation-adjusted league table. The figures retain their original dates and currencies; historical dollar equivalents are identified where used.

Some entries concern money a company lost or recognised in its accounts. Others use estimates of costs spread across society. Those categories cannot be made identical by putting a dollar sign in front of them. The distinction is especially important near the top, where changing the scope of a nuclear-disaster estimate could change its position.

“Human error” is used broadly here to include mistakes in engineering, management and oversight. Where conduct involved deliberate deception, that is stated explicitly. Calling fraud a mistake would obscure responsibility; excluding the failures that enabled it would obscure the mechanism.

Wars, slavery, colonial exploitation and sweeping political programmes are excluded. Their costs cannot sensibly be reduced to a single comparable mistake. Unexercised business opportunities are excluded too: declining an investment that later became valuable is not the same as destroying an asset already owned.

Finally, this ranks financial scale, not suffering. Compensation reflects legal arrangements and bargaining power as well as harm. A disaster with a smaller settlement can have a greater human toll than one with an enormous corporate bill.

8. Mars Climate Orbiter: A $125 Million Spacecraft and an Unchecked Interface

On 23 September 1999, NASA lost contact with Mars Climate Orbiter as it arrived at Mars. The spacecraft had travelled for roughly nine months to study the planet’s atmosphere and support communications for other missions. A navigation error brought that journey to an unsuccessful end.

The benchmark here is the commonly documented $125 million spacecraft cost. That is narrower than the cost of an entire programme, including launch and operations. Keeping that boundary visible prevents a familiar mistake in rankings: comparing the price of one vehicle with another mission’s complete budget.

The technical failure involved units. Ground software supplied thruster data in pound-force seconds where the navigation process expected newton seconds. These units describe impulse: the effect of a force acting over time. They are not interchangeable. The resulting mismatch corrupted the calculation of how the spacecraft’s path was changing.

The memorable version is that NASA forgot the metric system. The more useful account concerns an interface: the point where one team’s output became another team’s input. A numerical file could be successfully generated, transmitted and processed while carrying the wrong physical meaning.

Consider a simpler hypothetical example. A delivery business receives a weight of “100” and assumes kilograms when the sender means pounds. Nothing necessarily crashes. The database accepts the number. A report looks tidy. The error becomes visible only when a later decision depends on what that number actually represents.

That makes interface failures unusually deceptive. Technical success at moving information can conceal failure at interpreting it. Checking that a file exists is weaker than checking that its contents obey the receiving system’s assumptions.

The engineering lesson is therefore more demanding than asking talented people to be careful. Units should be explicit, tested and checked against independent expectations. A system should make incompatible meanings difficult to pass through unnoticed.

There is also a limit to the hindsight judgement. Space exploration involves genuine uncertainty, and losing a mission does not by itself establish negligence. In this case, however, the identified mismatch was avoidable. The risk came from how organisations coordinated known requirements, rather than from an undiscovered property of Mars.

The spacecraft’s price captures the lost hardware. It cannot adequately describe the research that never happened or the time invested by people whose instrument never delivered its intended observations.

7. Knight Capital: More Than $460 Million Lost After a Software Deployment

On 1 August 2012, Knight Capital’s automated order-routing system began executing trades it should not have made. According to the US Securities and Exchange Commission, the incident produced more than four million executions involving 154 stocks during approximately 45 minutes. The eventual loss exceeded $460 million.

The regulator traced the failure to defective dormant functionality and an unsuccessful software deployment. New code had not been correctly installed across the relevant servers. Orders activated an old function that failed to recognise when its task should end.

The SEC also identified 97 automated emails generated before the market opened. They referred to an error, but had not been designed as system alerts and were not acted upon in time. This was a missed opportunity to detect the problem, rather than evidence that staff consciously dismissed 97 explicit warnings of impending bankruptcy.

The distinction matters. An organisation can possess evidence without having an effective warning system. A message needs an owner, an interpretation and an action threshold. Otherwise, it becomes another item among the routine notifications people receive.

Knight’s case also reveals why speed changes the character of operational risk. A human can make a poor trade and then pause. An automated process can repeat a faulty action while its operators are still trying to understand the first symptom. Diagnosis and damage occur on different timescales.

Imagine a hypothetical system limited to £10,000 of exposure. A faulty instruction can be expensive, but its damage has a boundary. Remove that boundary while allowing rapid repetition and the same underlying defect becomes a threat to the institution. The difference lies in permission and containment, not merely programming quality.

That is why “test the software” is incomplete advice. Testing reduces the chance of a fault reaching production. Independent limits reduce the consequences when testing misses something. Both are needed because no finite test suite proves that every future interaction will be safe.

The same distinction helps frame questions about software authorised to move money. Knight’s system was not a modern generative AI agent. The relevant parallel is narrower: an automated tool can produce real losses when its authority exceeds the controls surrounding it.

The expensive assumption is that a machine doing something quickly must also know when to stop.

6. Barings: £827 Million in Hidden Losses, With More Required to Close the Positions

Barings collapsed in February 1995 after unauthorised trading by Nick Leeson in Singapore. The parliamentary account of the investigation put cumulative losses at £827 million after the collapse. The Reserve Bank of Australia’s subsequent analysis put the total at £927 million when closing out the positions was included.

These are contemporary pounds, not today’s money. Either measure places the failure well above Knight’s loss and far below the multibillion-euro corporate scandal that follows. The £100 million difference also demonstrates why the date and boundary of a loss calculation matter.

Leeson’s conduct involved concealment and deception. It should not be softened into an innocent trading error. The institutional failure was that management and control arrangements allowed the hidden exposure to grow until it exceeded the bank’s ability to absorb it.

The parliamentary statement described losses increasing from more than £20 million at the end of 1993 to more than £200 million a year later. London continued supplying funds without adequate independent checks against the underlying trading position. The bank was financing a reality it had failed to verify.

A central weakness was the combination of trading responsibilities with control over the records used to account for those activities. Oversight cannot be independent if the person taking the risk can also shape the evidence by which that risk is assessed.

This is different from simply trusting an employee too much. Trust is necessary in any organisation. The problem arises when trust substitutes for a process that could reveal unwelcome facts without relying on the trusted person’s cooperation.

A useful hypothetical test is to ask who could prove that a profitable business unit was actually losing money. If every answer leads back to the unit itself, senior management may be receiving a polished story rather than independent evidence.

The case also challenges the comfortable idea that impressive results make scrutiny less urgent. Exceptional reported performance creates a reason to understand the activity more closely. Otherwise, the apparent success can become the justification for weakening the checks that would expose it.

Barings offers a warning about scale as well. A loss need not be the largest in history to destroy its owner. What matters to survival is the relationship between exposure and the resources available to absorb it. A relatively modest institution can be ruined by a sum that a much larger company survives.

Financial rankings show the size of the bill. Capital determines whether anyone remains to pay it.

5. Volkswagen’s Diesel Scandal: €31.3 Billion Reported by March 2020

Volkswagen’s emissions scandal was not an accidental software malfunction. The relevant software enabled vehicles to behave differently during emissions testing from the way they behaved in ordinary use. The US Environmental Protection Agency describes it as a prohibited defeat device.

For certain affected vehicles, nitrogen oxide emissions during normal operation could reach up to 40 times the applicable standard. That figure does not mean every Volkswagen vehicle emitted 40 times every pollution limit. It concerns particular vehicles, pollutants and testing circumstances.

By March 2020, Volkswagen said the scandal had cost €31.3 billion in fines and settlements. This is a dated corporate benchmark, not a claim that every subsequent liability had been settled or that environmental and health damage had been comprehensively priced.

There is an accounting trap here. Cash paid in a later year can settle a cost already recognised earlier. Adding every reported payment to every previously announced provision can count the same obligation twice. A dramatic running total is only useful if its components are genuinely additional.

The underlying failure concerned the relationship between a test and its purpose. Emissions testing was intended to establish compliance with pollution requirements. Software that recognised the test conditions could produce reassuring results without delivering the corresponding performance on the road.

That creates a broader problem for any organisation governed by targets. A measure is useful because it stands for something that matters. Once people optimise the appearance of the measure while undermining its purpose, the dashboard can improve as the real situation deteriorates.

This does not mean all targets encourage cheating or that measurement should be abandoned. It means verification must sometimes examine behaviour outside the familiar assessment environment. Predictable checks are easier to manipulate than observations that test whether the underlying claim holds under varied conditions.

There is also a moral boundary. Pressure to deliver a product may explain the context in which bad decisions occur; it does not turn deliberate deception into an unavoidable engineering compromise. The options available to a company include changing the product, changing its claims or accepting a commercial disadvantage.

The ranking places Volkswagen above a destroyed bank because the documented corporate cost is much larger. Yet its distinctive lesson concerns information: customers and regulators were making decisions using an assurance the technology was designed to defeat.

A failed test would have made the problem visible. Passing the wrong kind of test allowed it to continue.

4. Deepwater Horizon: A $67 Billion Cumulative Charge in BP’s 2018 Accounts

The Deepwater Horizon disaster killed 11 workers on 20 April 2010 and caused a major oil spill in the Gulf of Mexico. The platform was operating at the Macondo well. The immediate emergency grew out of a chain of failures involving well integrity, interpretation, procedures and protective equipment.

BP’s 2018 annual report recorded a cumulative pre-tax income-statement charge of $67 billion associated with the spill. That included response costs, litigation and claims, environmental obligations and other items, with settlements from third parties credited against the total. It was an accounting measure through 2018, not simply cash spent that year or a complete valuation of the disaster.

One important point in the sequence was a negative-pressure test, intended to help establish whether the well would remain secure under reduced pressure. The Chemical Safety Board found that the crew lacked a written procedure containing clear acceptance criteria and instructions for deviations. Unexpected results were observed during the testing process.

The significance is practical. A safety test needs more than a requirement that somebody perform it. It needs a shared understanding of what constitutes failure and what must happen next. Otherwise, ambiguous evidence leaves room for an unsafe process to continue.

Consider the difference between two hypothetical instructions: “check the pressure before proceeding” and “stop if this specified condition appears; restart only after independent review”. The first requires an action. The second constrains a decision. They can look similar on a checklist while providing very different protection.

This distinction also explains why counting completed checks is a weak substitute for examining their quality. A document can show that a test happened without establishing that its result justified continuation. Administrative completion and physical safety are different outcomes.

It would still be wrong to attribute the entire disaster to one misinterpretation. Multiple barriers should have prevented a dangerous influx from becoming a fatal explosion. Focusing only on the final people facing the emergency leaves earlier design and management choices outside the picture.

The financial aftermath reveals another asymmetry. Decisions about how to conduct an operation are concentrated within organisations. The consequences can spread to workers’ families, coastal businesses, public authorities and ecosystems. The people carrying those costs may have had no meaningful influence over the original choices.

Even a very large corporate charge therefore answers a limited question: what did the company recognise financially? It cannot tell us that everyone affected was restored to their previous position.

3. Fukushima Daiichi: A ¥21.5 Trillion Government Estimate in 2016

The earthquake and tsunami of 11 March 2011 were natural disasters. The nuclear emergency at Fukushima Daiichi also reflected human decisions about preparation, protection and response. Those statements are compatible.

Japan’s parliamentary investigation concluded that the accident was preventable and strongly criticised the relationships between the operator, regulators and government. Its account emphasised organisational and regulatory failures rather than reducing the event to the competence of an individual worker.

In December 2016, Japan’s Ministry of Economy, Trade and Industry estimated disaster-related costs at ¥21.5 trillion, approximately $188 billion at the exchange rate used in contemporary reporting. The estimate included decommissioning, compensation, decontamination and contaminated-soil storage. It was a projection made in 2016, not a final bill or a fresh 2026 valuation.

The important engineering question is how much of a safety system can be disabled by one event. Backup arrangements are only meaningfully independent if they can survive the circumstances that defeat the primary system. Several alternatives do not provide several layers of protection when all share the same vulnerability.

A household analogy helps, provided its limits are clear. Owning three torches provides little resilience if every battery is stored in the same flooded cupboard. The number of backups looks reassuring; their common exposure determines whether they work when needed.

Nuclear facilities are vastly more complicated, but the underlying reasoning remains useful. Safety requires examining combinations of failures, including the loss of the resources normally used to recover. Planning around an isolated equipment fault is different from planning around an event that damages the surrounding infrastructure too.

The strongest counterargument is that preparation cannot eliminate every conceivable natural hazard. That is true. No society can purchase infinite protection, and hindsight makes extreme events appear easier to predict than they were. The relevant criticism must therefore concern risks that could reasonably have been recognised and addressed, rather than demand perfect foresight.

That is why the investigation’s findings matter. They provide a basis for examining institutional choices beyond the simple observation that an extraordinary wave arrived.

The costs also persist in unfamiliar ways. A conventional building can sometimes be demolished and replaced relatively quickly. A severely damaged nuclear site requires careful characterisation, specialised handling and long-term management. Uncertainty about what can safely be done becomes part of the economic burden.

An emergency plan is most valuable when it remains workable after the environment stops behaving as expected.

2. Chernobyl: Roughly $700 Billion in One Broad Thirty-Year Review

On 26 April 1986, Chernobyl’s reactor four was destroyed during a test. The accident released radioactive material and left consequences extending far beyond the power station. Its inclusion near the top rests on that broad burden rather than the replacement value of the reactor.

A 2016 literature review highlighted by the University of Southern California estimated roughly $700 billion in costs over the preceding 30 years. This is a broad research estimate incorporating indirect consequences, including health-related burdens. It is not an audited invoice, a universally agreed total or a figure that can be compared mechanically with BP’s accounts.

That scope is also why Chernobyl is placed above the particular Fukushima benchmark used here. Different studies and accounting boundaries could alter their relative positions. The robust conclusion is that both generated consequences measured over decades, not that one was precisely a given multiple of the other.

The technical explanation also resists a single-person story. The International Atomic Energy Agency’s INSAG-7 report reassessed the earlier account, giving greater attention to reactor design, inadequate information and failures of safety management alongside operational actions.

Under the accident conditions, features of the reactor could increase reactivity as steam formation increased. The control-rod design could also initially add reactivity during insertion under particular conditions. These characteristics made the interaction between the plant and its operators critically important.

The broader lesson concerns what people are equipped to know. A rulebook cannot compensate fully for important hazards that are poorly communicated. Nor can training be judged adequate merely because workers can repeat the approved procedure if the equipment can behave in a dangerous, unexpected way.

This does not remove individual responsibility. It changes the questions needed to assign it fairly. What information was available? Which actions breached meaningful safeguards? Which safeguards were absent or defective before the shift began? Treating every contributing factor as one undifferentiated “human error” makes these distinctions disappear.

The case also shows why a disaster’s economic consequences can outlive the institutions that created it. Contaminated land, displaced communities and continuing management obligations do not vanish when corporate structures or political systems change. Someone else inherits the task.

Money spent containing damage is necessary, but it carries an opportunity cost. Engineers, public funds and administrative capacity committed to managing a legacy cannot simultaneously serve every other public need. That foregone use is harder to count than a construction contract, yet it is part of why the economic shadow becomes so long.

The disaster altered more than an asset. It changed what entire places could safely be used for.

1. The 2007–09 Financial Crisis: An Estimated $6 Trillion to $14 Trillion in Lost US Output

The highest entry is also the least like an isolated mistake. The financial crisis emerged from interacting failures in lending, borrowing, risk assessment, institutional management and public oversight. Its damage spread through a system that linked ordinary household finances to highly leveraged financial institutions.

A 2013 paper by Tyler Atkinson, David Luttrell and Harvey Rosenblum, published by the Federal Reserve Bank of Dallas, estimated lost American output at $6 trillion to $14 trillion in 2012 dollars. The calculation covered 2008–2023 and depended on assumptions about the path the economy would otherwise have followed and its return towards that path.

That is a model-based estimate published in 2013, including future years at the time. It is not a subsequently audited global total, the amount handed to banks, or money that disappeared from a single account. Its scale concerns economic activity that the authors estimated was foregone.

The distinction is crucial. A government rescue can involve a loan or investment that is later repaid. Lost output means goods and services that were never produced. Adding rescue commitments, falling share prices and estimated lost production together would mix categories and risk double-counting.

The Financial Crisis Inquiry Commission’s majority concluded that the crisis was avoidable, identifying failures of regulation, governance and risk management alongside excessive borrowing and other weaknesses. The commission also published dissenting views. There was no unanimous explanation assigning every cause the same weight.

The central transmission mechanism is nevertheless understandable. Borrowing allows a financial institution to hold assets much larger than its own capital. That can increase returns when prices rise. It also means a relatively small decline in asset values can consume a large proportion of the owners’ cushion against loss.

Now add dependence on funding that must frequently be renewed. An institution can come under pressure because lenders become unwilling to keep financing it. Selling assets to obtain cash may depress prices, weakening others that hold similar assets. An individual attempt to become safer can therefore worsen conditions across the system.

That is an analytical reason why this entry belongs in a different financial category from a failed spacecraft. The damage is transmitted through relationships. A factory that made no mortgage loans can still lose orders when customers cut spending and credit becomes scarce.

It also connects private decisions with the constraints on public finances. A weakened economy changes the resources available to governments and the demands placed upon them. The consequences need not remain where the original risk was taken.

The crisis therefore leads this selection on the stated estimate, not because every economic loss can be attributed to one decision. Its defining feature was the capacity of interacting failures to damage the productive economy beyond the institutions immediately involved.

The Safeguard That Matters Is the One That Changes the Decision

There is a tempting explanation for these events: people were careless, greedy or overconfident. Sometimes those descriptions capture part of the truth. They are still insufficient instructions for preventing another catastrophe.

Each case raises a more concrete question. Can incompatible data enter unnoticed? Can a system act faster than its limits can restrain it? Can the person taking a risk control the evidence about that risk? Can an organisation pass a test while defeating its purpose? What happens when a safety result is ambiguous?

The answer has to exist before the emergency. A warning without an owner, a reviewer without independence or a stop procedure without practical authority may create the appearance of protection while leaving the decision unchanged.

This is where the ability to resist harmful instructions becomes an organisational question as well as a personal one. Encouraging employees to speak up achieves little if nobody must respond, if evidence cannot reach an independent decision-maker or if stopping work exists only as a theoretical entitlement.

There is a useful test for any claimed safeguard: identify a plausible warning and follow it to the exact action it would trigger. Name who receives it, who decides, what stops automatically and what evidence permits a restart. If that chain cannot be described, the organisation may have documented a concern without controlling it.

The prevention that succeeds will often look unimpressive afterwards. A deployment is delayed. A transaction is rejected. A test is repeated. A profitable-looking activity is questioned. The financial return is difficult to display because the catastrophe never arrives to reveal its price.

That creates the final challenge. Institutions must reward people for interrupting a dangerous process before the world supplies proof that interruption was necessary.

Sources

Next Reads

James Taylor
Next

The World’s Most Mysterious Disappearances