Mt.Gox exchange: the biggest hack in the history of cryptocurrencies

Main

• Mt.Gox is one of the first bitcoin exchanges in the world, launched in 2010. By the beginning of 2014, the platform accounted for 70% of the total trading volume of the first cryptocurrency.
• In 2014, Mt.Gox stopped working due to the discovery of a “hole” in user balances due to a hacker attack. During 2011-2013, the attackers managed to quietly withdraw 650,000 BTC from the exchange. This was the largest hack in the history of cryptocurrencies.
• Since 2018 Mt. Gox is in the process of civil rehabilitation, which involves the payment of the remaining cryptocurrency in the accounts of the exchange to affected customers. In total, applications for compensation were submitted by about 25,000 users.
• The organizers and perpetrators of the Mt.Gox hack have not yet been found. In the United States, the former administrator of the Russian BTC-e exchange, Alexander Vinnik, is being tried on charges of laundering cryptocurrency stolen from Mt.Gox.

Who and when discovered Mt.Gox

The history of Mt.Gox did not start with cryptocurrency. In 2007, Jed McCaleb, the future co-founder of the crypto projects Ripple and Stellar, registered the site mtgox.com. On it, he launched a platform called “MAgic: The Gathering Oline EXchange” for trading cards of the popular fantasy game. In the abbreviated version, the name of the service sounded like Mt.Gox.

After McCaleb learned about cryptocurrency in the summer of 2010, he decided to transform Mt.Gox into a bitcoin exchange. A year later, McCaleb sold it to the French developer Mark Karpeles, who lived in Japan, citing the lack of time for the project to develop.

According to information Rolling stone, Karpeles got Mt.Gox virtually free of charge. In exchange, he was required to pay McCaleb 50% of the profits in the first 6 months of ownership and 12% in the future.

Meanwhile, Mt.Gox quickly gained popularity. In 2011, the user base of the platform already numbered tens of thousands of clients, and by 2013, the volume of bitcoin trading on the site was about 70% from the global.

The first hacker attacks on the exchange

Security problems began with Mt.Gox even before the sale of the platform. As it became known later, in March 2011, Karpeles informed McCaleb about the loss of user funds in the amount of about 80,000 BTC. In the end, they turned a blind eye to it. Already in 2020, Karpeles announced that the stolen funds were transferred to a blockchain address owned by Bitcoin SV creator Craig Wright. Some suggestthat it is he who is behind the subsequent hacking of the platform.

The first publicly documented attack on Mt.Gox took place in June 2011. For hackers managed to kidnap at least 25,000 BTC, which was about $400,000 at the time. As a result, the price of bitcoin on Mt.Gox collapsed from $17 to almost zero.

Based on the results of an internal investigation, Karples came to the conclusion that the attackers hacked Jed McCaleb’s old administrator account, which allowed access to the funds and personal data of the exchange’s customers.

About a week after the attack on Mt. Gox restored work, and Karples proved that he controls the bitcoins on the platform’s wallets by making a confirmation transactionand reimbursed customers for losses.

Successes and new challenges (2011-2013)

After the first attack, activity on Mt.Gox gradually recovered, and by 2013 it had become the largest bitcoin trading platform in the world. The company moved its head office to the prestigious business district of Tokyo, and Karpeles became an active speaker of the bitcoin industry in the media.

As it turned out later, with external successes, Mt. Gox experienced great internal difficulties. For example, she had no control over the quality and security of the code. In addition, the project lacked a system of financial accounting and control of balances and reserves. Simply put, no one followed the flow of money and cryptocurrencies.

Most of Mt.Gox’s users were from the US, however, the exchange did not have any kind of license to operate there. Therefore, in May 2013, the United States authorities seized the project’s funds in the amount of about $5 million, which were stored at the Dwolla processing service. After that Mt. Gox still obtained a cash operator license from FinCEN.

However, in June, the crypto exchange stopped dollar deposits after the Japanese bank Mizuho refused to serve its accounts. Users also began to massively complain about long-term withdrawals.

Re-hacking and shutting down Mt.Gox

In February 2014, Mt.Gox abruptly halted Bitcoin withdrawals. The platform’s press release said that a certain bug in the bitcoin code made it possible to actually double spend coins, which the attackers applied to the exchange’s blockchain address. After that, the platform finally stopped all withdrawals.

By the end of the month, the price of bitcoin on Mt.Gox was only 20% of the average market, which was a clear indication of the confidence of investors that the project would no longer be able to solve the problems that had arisen. On February 24, all trading operations on the platform were stopped, and a few hours later its website stopped working.

As it turned out later, then the exchange team found theft of approximately 750,000 BTC users who have not noticed for several years. As a result, the platform was insolvent. February 28 Mt.Gox announced on bankruptcy and closure.

How many bitcoins were stolen from Mt.Gox

As detailed in the bankruptcy filing, in addition to user cryptocurrencies, the criminals stole 100,000 BTC from the stock exchange. Thus, the total amount of theft amounted to 850,000 BTC, or approximately 7% of the entire emission of cryptocurrency at that time.

The total amount of theft was estimated at $440-480 million. As of September 2022, when the price of bitcoin is approximately $20,000, this is already about $17 billion.

In addition to bitcoin, $28 million in fiat money also “disappeared” from Mt.Gox bank accounts in Japan.

March 2014 at Mt.Gox reported about the “sudden” discovery of about 200,000 BTC stored on the address of the old format, which was used before June 2011. At the same time, the address was active just a few days before it was “found”. This reduced the total amount of cryptocurrency losses to 650,000 BTC, although it did not save Mt.Gox from closing.

Mt.Gox hack details

The second and largest hack of Mt.Gox was the result of a low level of security and numerous management errors. According to the findings of a study by WizSec, the second and largest attack began in 2011. Here’s what the experts found out:

• In September 2011, hackers managed to steal the private key from the hot bitcoin wallet of the Mt.Gox exchange. Thanks to him, the attackers gained control over the flows of users’ cryptocurrencies to the exchange;

• Using this private key, hackers imperceptibly, but regularly, devastated the exchange accounts for more than one year;

• In mid-2013, when the volume of deposits on the exchange slowed down, hackers immediately removed 630,000 BTC from the Mt.Gox wallet.

How the arrest of Alexander Vinnik is connected with Mt.Gox

Since many of the affected Mt.Gox users were from the United States, the country’s authorities launched an investigation.

At the end of July 2017, the administrator of the largest Russian crypto exchange BTC-e Alexander Vinnik was detained in Greece. He was accused of laundering stolen Mt.Gox funds. In total, according to the US Department of Justice, a criminal organization with the participation of Vinnik was able to launder almost 307,000 BTC out of 850,000 BTC stolen from Mt.Gox through BTC-e.

Requests for the extradition of Vinnik for subsequent trial were sent to Greece by several countries at once – the United States, France and Russia. In 2020, he was extradited to France, where he was eventually sentenced to 5 years in prison and fined 100,000 euros. In the summer of 2022, Vinnik was extradited to the United States. There he faces 55 years in prison.

Investigation and trial

In May 2016, the Canadian crypto exchange Kraken, which assisted in the investigation, completed the process of collecting and analyzing creditors’ claims. According to Kraken, 24,750 users have applied for payouts.

By decision of the Tokyo District Court, which became the main instance for the Mt.Gox case, the process of recovering funds from creditors moved from bankruptcy to civil rehabilitation. In the first case, creditors would receive compensation equivalent to the assets at the time the company filed for bankruptcy, in the second, “physical” bitcoins or the equivalent amount in fiat currency at the time of payments.

In February 2021, the court approved a plan to refund bitcoins to creditors, and only in July 2022, Mt.Gox trustee Nobuaki Kobayashi announced the start of preparations for a refund. At the time of preparation of the material, mid-September 2022, no exact figures and dates regarding payments were indicated.

The further fate of Mark Karpeles

On August 1, 2015, Japanese police arrested the former head of Mt.Gox, Mark Karpeles. He was charged with fraud, misappropriation of funds and manipulation of the exchange’s computer system to artificially increase the balance of accounts.

But already in July 2016, Karples was released from prison on bail of about $ 95,000. In March 2019, he was found guilty of forging documents and sentenced to two years and six months in prison, later replacing the term with 4 years of probation.

In the spring of 2022, Karpeles announced his intention to open a crypto-rating agency and distribute NFTs to former Mt.Gox clients.

How much cryptocurrency is left on Mt.Gox addresses

It is known that the trustee of Mt.Gox Nobuaki Kobayashi at the beginning of 2018, before the transition from bankruptcy to civil rehabilitation, managed to sell part of the assets in BTC and BCH. April to May 2018 Kobayashi implemented 24,658 BTC and 25,331 BCH for a total of $406 million.

According to the service Cryptogroundwhich tracks the balance of the Mt.Gox wallet, there are a total of 137,891 BTC and 137,891 BCH on the exchange’s accounts, which, at the rate of September 15, 2022, is more than $2.3 billion.

How Mt.Gox customers will be compensated

Exact data on payments of bitcoins to creditors are not given in public documents. However, in 2021, a representative of CoinLab declared that for every bitcoin stolen from Mt.Gox users, they can only be reimbursed for 0.23 BTC.

After some time, special companies appeared offering to buy back their claims to the exchange from creditors. For example, at the end of 2019, the Fortress investment group sent a letter to creditors of the bankrupt Mt.Gox exchange offering to buy out their claims for $5,000 for each bitcoin. The benefit of the offer was the possibility of receiving payment without waiting for the completion of a lengthy litigation.

In dollar terms, 0.23 BTC will be worth about $4,600 at a price of $20,000 per bitcoin at the exchange rate on September 15, 2022. At the time of filing for bankruptcy in 2014, the price of bitcoin was at $489. This means almost a tenfold profit in dollar terms, despite the loss of more than three-quarters of bitcoin assets.

In the fall of 2021, a plan for reimbursement of money was published, which was approved by the court. However, payments to former Mt.Gox users have not yet begun.

Main

• Mt.Gox is one of the first bitcoin exchanges in the world, launched in 2010. By the beginning of 2014, the platform accounted for 70% of the total trading volume of the first cryptocurrency.
• In 2014, Mt.Gox stopped working due to the discovery of a “hole” in user balances due to a hacker attack. During 2011-2013, the attackers managed to quietly withdraw 650,000 BTC from the exchange. This was the largest hack in the history of cryptocurrencies.
• Since 2018 Mt. Gox is in the process of civil rehabilitation, which involves the payment of the remaining cryptocurrency in the accounts of the exchange to affected customers. In total, applications for compensation were submitted by about 25,000 users.
• The organizers and perpetrators of the Mt.Gox hack have not yet been found. In the United States, the former administrator of the Russian BTC-e exchange, Alexander Vinnik, is being tried on charges of laundering cryptocurrency stolen from Mt.Gox.

Who and when discovered Mt.Gox

The history of Mt.Gox did not start with cryptocurrency. In 2007, Jed McCaleb, the future co-founder of the crypto projects Ripple and Stellar, registered the site mtgox.com. On it, he launched a platform called “MAgic: The Gathering Oline EXchange” for trading cards of the popular fantasy game. In the abbreviated version, the name of the service sounded like Mt.Gox.

After McCaleb learned about cryptocurrency in the summer of 2010, he decided to transform Mt.Gox into a bitcoin exchange. A year later, McCaleb sold it to the French developer Mark Karpeles, who lived in Japan, citing the lack of time for the project to develop.

According to information Rolling stone, Karpeles got Mt.Gox virtually free of charge. In exchange, he was required to pay McCaleb 50% of the profits in the first 6 months of ownership and 12% in the future.

Meanwhile, Mt.Gox quickly gained popularity. In 2011, the user base of the platform already numbered tens of thousands of clients, and by 2013, the volume of bitcoin trading on the site was about 70% from the global.

The first hacker attacks on the exchange

Security problems began with Mt.Gox even before the sale of the platform. As it became known later, in March 2011, Karpeles informed McCaleb about the loss of user funds in the amount of about 80,000 BTC. In the end, they turned a blind eye to it. Already in 2020, Karpeles announced that the stolen funds were transferred to a blockchain address owned by Bitcoin SV creator Craig Wright. Some suggestthat it is he who is behind the subsequent hacking of the platform.

The first publicly documented attack on Mt.Gox took place in June 2011. For hackers managed to kidnap at least 25,000 BTC, which was about $400,000 at the time. As a result, the price of bitcoin on Mt.Gox collapsed from $17 to almost zero.

Based on the results of an internal investigation, Karples came to the conclusion that the attackers hacked Jed McCaleb’s old administrator account, which allowed access to the funds and personal data of the exchange’s customers.

About a week after the attack on Mt. Gox restored work, and Karples proved that he controls the bitcoins on the platform’s wallets by making a confirmation transactionand reimbursed customers for losses.

Successes and new challenges (2011-2013)

After the first attack, activity on Mt.Gox gradually recovered, and by 2013 it had become the largest bitcoin trading platform in the world. The company moved its head office to the prestigious business district of Tokyo, and Karpeles became an active speaker of the bitcoin industry in the media.

As it turned out later, with external successes, Mt. Gox experienced great internal difficulties. For example, she had no control over the quality and security of the code. In addition, the project lacked a system of financial accounting and control of balances and reserves. Simply put, no one followed the flow of money and cryptocurrencies.

Most of Mt.Gox’s users were from the US, however, the exchange did not have any kind of license to operate there. Therefore, in May 2013, the United States authorities seized the project’s funds in the amount of about $5 million, which were stored at the Dwolla processing service. After that Mt. Gox still obtained a cash operator license from FinCEN.

However, in June, the crypto exchange stopped dollar deposits after the Japanese bank Mizuho refused to serve its accounts. Users also began to massively complain about long-term withdrawals.

Re-hacking and shutting down Mt.Gox

In February 2014, Mt.Gox abruptly halted Bitcoin withdrawals. The platform’s press release said that a certain bug in the bitcoin code made it possible to actually double spend coins, which the attackers applied to the exchange’s blockchain address. After that, the platform finally stopped all withdrawals.

By the end of the month, the price of bitcoin on Mt.Gox was only 20% of the average market, which was a clear indication of the confidence of investors that the project would no longer be able to solve the problems that had arisen. On February 24, all trading operations on the platform were stopped, and a few hours later its website stopped working.

As it turned out later, then the exchange team found theft of approximately 750,000 BTC users who have not noticed for several years. As a result, the platform was insolvent. February 28 Mt.Gox announced on bankruptcy and closure.

How many bitcoins were stolen from Mt.Gox

As detailed in the bankruptcy filing, in addition to user cryptocurrencies, the criminals stole 100,000 BTC from the stock exchange. Thus, the total amount of theft amounted to 850,000 BTC, or approximately 7% of the entire emission of cryptocurrency at that time.

The total amount of theft was estimated at $440-480 million. As of September 2022, when the price of bitcoin is approximately $20,000, this is already about $17 billion.

In addition to bitcoin, $28 million in fiat money also “disappeared” from Mt.Gox bank accounts in Japan.

March 2014 at Mt.Gox reported about the “sudden” discovery of about 200,000 BTC stored on the address of the old format, which was used before June 2011. At the same time, the address was active just a few days before it was “found”. This reduced the total amount of cryptocurrency losses to 650,000 BTC, although it did not save Mt.Gox from closing.

Mt.Gox hack details

The second and largest hack of Mt.Gox was the result of a low level of security and numerous management errors. According to the findings of a study by WizSec, the second and largest attack began in 2011. Here’s what the experts found out:

• In September 2011, hackers managed to steal the private key from the hot bitcoin wallet of the Mt.Gox exchange. Thanks to him, the attackers gained control over the flows of users’ cryptocurrencies to the exchange;

• Using this private key, hackers imperceptibly, but regularly, devastated the exchange accounts for more than one year;

• In mid-2013, when the volume of deposits on the exchange slowed down, hackers immediately removed 630,000 BTC from the Mt.Gox wallet.

How the arrest of Alexander Vinnik is connected with Mt.Gox

Since many of the affected Mt.Gox users were from the United States, the country’s authorities launched an investigation.

At the end of July 2017, the administrator of the largest Russian crypto exchange BTC-e Alexander Vinnik was detained in Greece. He was accused of laundering stolen Mt.Gox funds. In total, according to the US Department of Justice, a criminal organization with the participation of Vinnik was able to launder almost 307,000 BTC out of 850,000 BTC stolen from Mt.Gox through BTC-e.

Requests for the extradition of Vinnik for subsequent trial were sent to Greece by several countries at once – the United States, France and Russia. In 2020, he was extradited to France, where he was eventually sentenced to 5 years in prison and fined 100,000 euros. In the summer of 2022, Vinnik was extradited to the United States. There he faces 55 years in prison.

Investigation and trial

In May 2016, the Canadian crypto exchange Kraken, which assisted in the investigation, completed the process of collecting and analyzing creditors’ claims. According to Kraken, 24,750 users have applied for payouts.

By decision of the Tokyo District Court, which became the main instance for the Mt.Gox case, the process of recovering funds from creditors moved from bankruptcy to civil rehabilitation. In the first case, creditors would receive compensation equivalent to the assets at the time the company filed for bankruptcy, in the second, “physical” bitcoins or the equivalent amount in fiat currency at the time of payments.

In February 2021, the court approved a plan to refund bitcoins to creditors, and only in July 2022, Mt.Gox trustee Nobuaki Kobayashi announced the start of preparations for a refund. At the time of preparation of the material, mid-September 2022, no exact figures and dates regarding payments were indicated.

The further fate of Mark Karpeles

On August 1, 2015, Japanese police arrested the former head of Mt.Gox, Mark Karpeles. He was charged with fraud, misappropriation of funds and manipulation of the exchange’s computer system to artificially increase the balance of accounts.

But already in July 2016, Karples was released from prison on bail of about $ 95,000. In March 2019, he was found guilty of forging documents and sentenced to two years and six months in prison, later replacing the term with 4 years of probation.

In the spring of 2022, Karpeles announced his intention to open a crypto-rating agency and distribute NFTs to former Mt.Gox clients.

How much cryptocurrency is left on Mt.Gox addresses

It is known that the trustee of Mt.Gox Nobuaki Kobayashi at the beginning of 2018, before the transition from bankruptcy to civil rehabilitation, managed to sell part of the assets in BTC and BCH. April to May 2018 Kobayashi implemented 24,658 BTC and 25,331 BCH for a total of $406 million.

According to the service Cryptogroundwhich tracks the balance of the Mt.Gox wallet, there are a total of 137,891 BTC and 137,891 BCH on the exchange’s accounts, which, at the rate of September 15, 2022, is more than $2.3 billion.

How Mt.Gox customers will be compensated

Exact data on payments of bitcoins to creditors are not given in public documents. However, in 2021, a representative of CoinLab declared that for every bitcoin stolen from Mt.Gox users, they can only be reimbursed for 0.23 BTC.

After some time, special companies appeared offering to buy back their claims to the exchange from creditors. For example, at the end of 2019, the Fortress investment group sent a letter to creditors of the bankrupt Mt.Gox exchange offering to buy out their claims for $5,000 for each bitcoin. The benefit of the offer was the possibility of receiving payment without waiting for the completion of a lengthy litigation.

In dollar terms, 0.23 BTC will be worth about $4,600 at a price of $20,000 per bitcoin at the exchange rate on September 15, 2022. At the time of filing for bankruptcy in 2014, the price of bitcoin was at $489. This means almost a tenfold profit in dollar terms, despite the loss of more than three-quarters of bitcoin assets.

In the fall of 2021, a plan for reimbursement of money was published, which was approved by the court. However, payments to former Mt.Gox users have not yet begun.