We nd that nancial systems exhibit a robust-yet-fragile tendency: while the probability of contagion may be low, the effects can be extremely widespread when problems occur. The model also highlights how a priori indistinguishable shocks can have very different consequences for the nancial system, depending on the particular point in the network structure that the shock hits. This cautions against assuming that past resilience to a particular shock will continue to apply to future shocks of a similar magnitude. And it explains why the evidence of the resilience of the nancial system to fairly large shocks prior to 2007 (eg 9/11, the Dotcom crash, and the collapse.