Other
Mt. Gox Bitcoin Exchange Collapse — 850,000 BTC Lost (Hack + Insolvency)
Primary Source ↗Incident Details
Mt. Gox was once the world’s largest Bitcoin exchange, handling over 70% of global BTC transactions at its peak. On February 7, 2014, Mt. Gox suspended all Bitcoin withdrawals without explanation. On February 24, 2014, the exchange’s website went offline and it filed for bankruptcy protection in Tokyo on February 28, 2014. A leaked internal crisis document revealed that approximately 744,408 BTC belonging to customers and 100,000 BTC belonging to the company had gone missing — a total of approximately 850,000 BTC worth approximately $473 million at the time. The losses were attributed to theft exploiting Bitcoin’s transaction malleability flaw: attackers could alter the transaction ID of a pending withdrawal, causing Mt. Gox’s systems to believe the transaction had failed and re-send it, effectively double-spending. Mt. Gox CEO Mark Karpelès claimed this had been occurring for years undetected due to the exchange’s poor internal accounting. Subsequently, Mt. Gox ‘found’ approximately 200,000 BTC in an old-format wallet, reducing the net loss to approximately 650,000 BTC. Japanese and US investigators also examined allegations of internal theft and embezzlement by Karpelès himself. Karpelès was arrested by Japanese authorities in August 2015 and tried for embezzlement and data manipulation (not theft of the Bitcoin), ultimately receiving a suspended sentence in 2019. A separate criminal investigation identified Alexander Vinnik (alleged BTC-e operator) as having received large portions of the stolen Mt. Gox Bitcoin. The approximately 127,000 Mt. Gox creditors began receiving partial Bitcoin repayments only in 2024 — a decade after the collapse — as the bankruptcy trustee slowly distributed recovered assets worth far more in 2024 dollars. The Mt. Gox collapse destroyed trust in centralized Bitcoin exchanges and gave rise to the mantra ’not your keys, not your coins.’
Technical Details
- Initial Attack Vector
- Multiple attack vectors over multiple years: (1) 2011 auditor laptop compromise allowed private key theft and price manipulation; (2) ongoing transaction malleability exploitation allowed attackers to claim non-received Bitcoin withdrawals were unprocessed and have them re-sent; (3) internal control failures and alleged insider theft; Mt. Gox repeatedly processed duplicate withdrawal requests due to mishandling of Bitcoin transaction IDs
- Vendor / Product
- Mt. Gox (bitcoin exchange, Tokyo, operated by Tibanne Ltd., CEO Mark Karpelès)
Timeline
- 2011-09-01 Breach occurred
- 2014-02-07 Publicly disclosed
- 2014-02-07 Customers notified