In the realm of digital finance, few events have left as deep an impact as the infamous Mt. Gox hack. Serving as a stark reminder of the vulnerabilities and risks associated with cryptocurrency exchanges, this watershed incident continues to reverberate throughout the financial world long after its occurrence. The Mt. Gox hack represents a pivotal moment in the evolution of cryptocurrencies, raising crucial questions about security, regulation, and the future of digital assets.
This guide examines the cataclysmic hack that shook the foundations of the nascent crypto industry, providing a concise and comprehensive analysis of the events that unfolded. Amidst the relentless growth of cryptocurrencies in the early 2010s, Mt. Gox, once the world’s largest Bitcoin exchange, became synonymous with the burgeoning crypto space. However, in early 2014, it abruptly ceased trading, revealing the theft of a staggering number of Bitcoins worth hundreds of millions of dollars.
Exploring the factors that led to the Mt. Gox hack might shed light on the security shortcomings and regulatory loopholes that were exploited. Additionally, we will examine the immediate aftermath of the hack, the consequences it imposed on the victims and the broader cryptocurrency ecosystem, and the subsequent efforts to recover the stolen funds.
By analyzing the Mt. Gox hack, we seek not only to understand the magnitude of its impact but also to draw valuable lessons to fortify the security and resilience of the ever-evolving cryptocurrency landscape.
What was Mt. Gox?
Mt. Gox was a Tokyo-based cryptocurrency exchange that dominated the crypto market between 2010 and 2014. It was launched on July 18 2010 by the American programmer Jed McCaleb.
By April 2013 into 2014, Mt. Gox had emerged as the world’s leading Bitcoin exchange, handling over 70% of global Bitcoin trades. During this period of surging Bitcoin prices, Mt. Gox took measures like suspending trading from 11th to 12th April for a “market cooldown.” However, after trading resumed, the value of a single Bitcoin dropped to a low of $55.59 before stabilizing above $100. In mid-May 2013, Mt. Gox traded a staggering 150,000 Bitcoins daily, according to the data provider Bitcoin Charts.
The platform, alternately known as MtGox or Mt. Gox, became synonymous with the early growth of cryptocurrencies. However, its remarkable rise was followed by a dramatic fall when the exchange was hacked and consequently declared bankruptcy in 2014, leaving a trail of legal battles and enduring speculation in its wake.
Despite its closure, the name “Mt. Gox” remains etched in the history of the digital finance world, serving as a cautionary tale about the vulnerabilities and risks associated with cryptocurrency exchanges.
Mt. Gox hack – What happened?
Mt. Gox’s change of owners
Almost a year after its launch in March 2011, the founder of Mt. Gox, Jed McCaleb, made the decision to sell the platform to French developer Mark Karpelès, who resided in Japan. McCaleb cited his lack of time to fully realize the potential of Mt. Gox and entrusted Karpelès to take the site to new heights.
However, the transition was not without challenges. On 13th June 2011, the Mt. Gox Bitcoin exchange experienced a devastating breach, with approximately BTC 25,000 (equivalent to US$400,000 at that time) stolen from 478 user accounts.
The situation worsened on Friday, 17th June, when the user database of Mt. Gox was leaked for sale on pastebin, with the hacker identified as cRazIeStinGeR and tied to the email address auto36299386@hushmail.com.
Subsequent to this incident, there were ongoing reports of further Bitcoin thefts from Mt. Gox accounts throughout that day.
Bitcoin price manipulation
Another significant event unfolded on 19th June, as fraudulent trades manipulated the nominal price of a Bitcoin on the Mt. Gox exchange, causing it to falsely drop to one cent. Allegedly, a hacker exploited compromised credentials from a Mt. Gox auditor’s computer to illegally transfer a large number of Bitcoins to himself.
Using the exchange’s software, the hacker executed a massive “ask” order at an arbitrary price, leading to the erroneous price drop. Although the price corrected to its accurate value after a brief period, numerous accounts with a total value exceeding $8,750,000 were impacted.
Mysterious Bitcoin transactions
To demonstrate control over the coins, Mt. Gox had previously announced the transfer of 424,242 Bitcoins from “cold storage” to a Mt. Gox address, which was executed in Block 132749.
Adding to the tumultuous journey of Mt. Gox, in October 2011, about two dozen transactions emerged in the blockchain (Block 150951) that sent a total of BTC 2,609 to invalid addresses. As these Bitcoins had no associated private keys, they were effectively lost. The standard client would reject such erroneous transactions, but nodes on the network did not, thereby revealing a vulnerability in the protocol
Dwolla anti-money laundering requirements
On 22nd February 2013, Dwolla, an e-commerce/online payment system company, introduced new anti-money laundering requirements, leading to temporary restrictions on some Dwolla accounts. Consequently, transactions from Mt. Gox to these accounts were canceled by Dwolla, and the funds failed to return to Mt. Gox accounts.
The Mt. Gox help desk addressed the issue, stating that withdrawals from Mt. Gox couldn’t be canceled, and they were actively working with Dwolla to locate the missing funds. Eventually, on 3rd May, nearly three months later, the funds were returned with a warning never to cancel any Dwolla withdrawals from Mt. Gox again.
CoinLab lawsuit against Mt. Gox
On 2nd May 2013, CoinLab filed a substantial $75 million lawsuit against Mt. Gox, citing a breach of contract. Both companies had previously entered a partnership in February 2013, with CoinLab responsible for handling all of Mt. Gox’s North American services.
The crux of CoinLab’s legal action lay in Mt. Gox’s alleged failure to facilitate the transfer of existing U.S. and Canadian customers from Mt. Gox to CoinLab as agreed upon.
US subsidiary of Mt. Cox run-ins with the DHS
On 15th May 2013, the US Department of Homeland Security (DHS) issued a warrant to seize funds from Mt. Gox’s US subsidiary’s account with payment processor Dwolla.
The warrant was based on the DHS’s assertion that the subsidiary was operating as an unregistered money transmitter in the US and lacked the necessary license from the US Financial Crimes Enforcement Network (FinCEN).
Subsequently, between May and July, the DHS seized over $5 million from the subsidiary’s account. It was only on 29th June 2013 that Mt. Gox finally received its money services business (MSB) license from FinCEN.
Amidst mounting pressure, Mt. Gox suspended withdrawals in US dollars on 20th June 2013. The Mizuho Bank branch in Tokyo, handling the exchange’s transactions, intensified pressure on Mt. Gox to close its account. Though on 4th July 2013, Mt. Gox announced the “full resumption” of withdrawals, by 5th September 2013, only a few US dollar withdrawals had been successfully processed.
Further exacerbating the situation, on 5th August 2013, Mt. Gox acknowledged “significant losses” incurred due to crediting deposits that hadn’t entirely cleared. Consequently, the company announced that new deposits would no longer be credited until the entire funds transfer process was completed.
Withdrawal delays
In November 2013, Wired Magazine reported extensive delays ranging from weeks to months in customers withdrawing cash from their Mt. Gox accounts. The article attributed these issues to the exchange being effectively cut off from the US banking system due to regulatory complications.
As of Februray 2014, the customer complaints about long delays had increased to more than 3,300 posts in a thread about the topic on the Bitcoin Talk online forum.
Mt. Gox halts Bitcoin withdrawals
On 7th February 2014, Mt. Gox made a sudden decision to suspend all Bitcoin withdrawals, citing the need to gain a comprehensive technical understanding of the currency processes.
Mt. Gox was not the only exchnage that halted withdrawals then. In a press release issued on 10th February 2014, the company attributed the withdrawal halt to transaction malleability, a bug in the Bitcoin software that allowed for the alteration of transaction details, leading to confusion about whether a Bitcoin transfer had occurred or not. Mt. Gox, however, assured its collaboration with the Bitcoin core development team and other experts to address and mitigate this issue.
Despite the other exchanges resuming full operations, Mt. Gox’s withdrawals remained on hold. On 17th February 2014, the company issued another press release outlining the steps it claimed to be taking to address security concerns.
However, during an email interview with the Wall Street Journal, CEO Mark Karpelès refrained from commenting on growing customer concerns about the exchange’s financial stability and did not provide a definite date for the resumption of withdrawals. He did mention that, if withdrawals resumed, the exchange would impose new daily and monthly limits on transactions.
As withdrawals remained halted on 20th February 2014, Mt. Gox released yet another statement without specifying a resumption date. A protest by two Bitcoin enthusiasts outside the Tokyo headquarters of Mt. Gox persisted.
Concerning security, the company decided to relocate its offices to a different location in Shibuya. During this period, Bitcoin prices quoted by Mt. Gox dropped to below 20% of the prices seen on other exchanges, reflecting the market’s loss of confidence in the likelihood of Mt. Gox being able to pay its customers.
Mt. Gox trading suspension
On 23rd February 2014, Mark Karpelès, the CEO of Mt. Gox, resigned from the board of the Bitcoin Foundation. Concurrently, all posts on the company’s Twitter account were erased.
The following day, on 24th February 2014, Mt. Gox abruptly suspended all trading activities, and shortly after, its website went offline, displaying a blank page. An alleged internal crisis management document, leaked later, indicated that the company was insolvent, having lost a staggering 744,408 Bitcoins to an undetected theft over several years. In response to the unfolding situation, six other major Bitcoin exchanges released a joint statement distancing themselves from Mt. Gox, just moments before its website vanished.
On 25th February 2014, Mt. Gox officially announced the closure of all transactions “for the time being,” citing recent news reports and the potential repercussions on their operations. Mark Karpelès, the chief executive, conveyed to Reuters that the company had reached a critical turning point.
During the period of Mt. Gox’s troubles, from 1st February 2014 until the end of March, the value of Bitcoin experienced a significant decline of 36%.
In relation to the stolen Bitcoins from Mt. Gox, the United States Department of Justice identified Alexander Vinnik, the owner of the BTC-e Bitcoin exchange, as an alleged key figure involved in the laundering process.
Mt. Gox Bankruptcy filling in Japan
On 28th February 2014, Mt. Gox filed for a form of bankruptcy protection called “minji saisei” or civil rehabilitation in Tokyo, aiming to secure a buyer and address its financial difficulties. The company revealed liabilities amounting to approximately 6.5 billion yen ($65 million at the time) and assets of 3.84 billion yen.
The situation worsened as Mt. Gox disclosed the loss of nearly 750,000 Bitcoins belonging to its customers and an additional 100,000 of its own Bitcoins, accounting for roughly 7% of all Bitcoins in circulation.
The estimated value of these missing Bitcoins amounted to around $473 million at the time of the bankruptcy filing. Mt. Gox stated that there was a high likelihood of the Bitcoins being stolen, attributing the loss to hackers and technical vulnerabilities that allowed fraudulent withdrawals.
Mt. Gox Bankruptcy filling in USA
Mt. Gox faced legal action from its customers, further exacerbating its financial crisis.
On 9th March 2014, the company filed for bankruptcy protection in the United States to temporarily halt legal action taken by traders who accused the Bitcoin exchange operation of fraudulent practices.
Some of the lost Bitcoins recovered
In an unexpected development, on 20th March 2014, Mt. Gox disclosed that it had found 199,999.99 Bitcoins, valued at approximately $116 million, in an old digital wallet used before June 2011.
Despite this discovery, the firm still reported a total loss of 650,000 Bitcoins, reducing its previous count of 850,000.
Arrest of Mt. Gox’s CEO
In April 2015, new evidence presented by Tokyo security company WizSec pointed to the conclusion that the majority, if not all, of the missing Bitcoins were stolen directly from Mt. Gox’s hot wallet over several years, starting from late 2011.
Following a series of events and legal proceedings, Mt. Gox’s CEO, Mark Karpelès, was arrested in August 2015 and charged with fraud, embezzlement, and manipulating the Mt. Gox computer system. However, these charges were not directly linked to the missing 650,000 Bitcoins.
Mt. Gox credirots lost $2.4 trillion in the circus
As the bankruptcy proceedings progressed, creditors of Mt. Gox claimed to have lost a staggering $2.4 trillion, demanding repayment. Nevertheless, the trustee overseeing the bankruptcy disclosed that only $91 million in assets had been located for distribution among claimants, despite the exchange’s earlier claims of holding over $500 million in assets.
In March 2018, the trustee reported that enough Bitcoins had been sold to cover the claims of creditors. In 2019, the Tokyo District Court found Mark Karpelès guilty of falsifying data, but acquitted him on other charges. He was sentenced to 30 months in prison, suspended for four years.
Russians charged for the Mt. Gox hack
In November 2021, two Russian nationals were charged by the United States in connection with the Mt. Gox. hack.
The Department of Justice revealed that Alexey Bilyuchenko, aged 43, and Aleksandr Verner, aged 29, stand accused of participating in a conspiracy to launder approximately 647,000 Bitcoins, which they obtained through the hack of Mt. Gox. The exchange faced a catastrophic collapse in 2014, resulting in the loss of what was then valued at about half a billion dollars in cryptocurrency.
Bilyuchenko played a significant role as a close associate of Alexander Vinnik, a prominent Russian cybercrime figure who was apprehended in Greece back in 2017. Vinnik faced a conviction for money laundering in France three years later and is presently awaiting trial in California, where he stands accused of operating BTC-e, a now-defunct Russian exchange that the Department of Justice had accused of catering to “cyber criminals worldwide.”
During Vinnik’s arrest, Bilyuchenko, who happened to be in Greece at the time, narrowly escaped capture by quickly disposing of his computer, tossing it into the sea, and immediately returning to Moscow, as previously reported by the BBC.
The Department of Justice has also implicated Bilyuchenko in charges of conspiring with Vinnik to run BTC-e between the years 2011 and 2017. Their alleged collaboration is believed to have facilitated the operation of the exchange during that period.
Future of Mt. Gox
In January 2021, CoinLab Inc. reached an agreement with the trustee overseeing the Mt. Gox bankruptcy, offering as much as 90% of the remaining Bitcoins involved in the proceedings to creditors.
In November 2021, Mr. Kobayashi, the trustee for Mt. Gox, issued a public announcement following the agreement reached between Japanese courts and Mt. Gox creditors on the rehabilitation plan. The plan outlines a phased registration and compensation approach for different creditors.
Approved rehabilitation creditors, equipped with unique creditor codes, are eligible to register on the MT. Gox Online Rehabilitation Claim Filing System. However, it’s important to note that the system does not allow for the submission of new rehabilitation claims. The Tokyo District Court had referred the rehabilitation draft to resolution in February 2021, finalizing the process and disallowing any new claims.
As of 6th July 2022, a Japanese trustee was holding close to 142,000 Bitcoins from the Mt. Gox case.
Payments to claimants are expected to begin before 31st October 2023.
Conclusion
The Mt. Gox hack stands as a pivotal event in the history of cryptocurrencies, serving as a stark reminder of the vulnerabilities and risks that accompany the digital finance landscape. The once-dominant exchange’s downfall shook the industry and left countless customers in financial distress, losing substantial sums of Bitcoin.
While several perpetrators behind the hack have been charged, the scars of Mt. Gox continues to linger, shaping the way regulators and users approach cryptocurrency security.
As the world of cryptocurrencies evolves, it is crucial for investors, exchanges, and regulatory bodies to learn from the lessons of Mt. Gox. Heightened security measures, robust risk management protocols, and transparent communication will be key pillars in ensuring the long-term sustainability and trustworthiness of the crypto ecosystem.
While the memories of Mt. Gox may fade, the impact it left on the industry will continue to shape its path towards greater resilience and maturity. As we look to the future, it is imperative to remain vigilant, as the landscape of digital finance continues to chart new territory, seeking a balance between innovation and safeguarding against potential threats.
