Ten years ago today, MtGox, the biggest Bitcoin exchange the world had yet seen, formally announced bankruptcy having lost $475 million worth of bitcoins without apparently knowing. A series of hacks, the most devastating of which was carried out supposedly under the nose of CEO Mark Karpelès for two and a half years, crippled the exchange and left its hundreds of thousands of customers penniless.
In this 10th anniversary piece, Mark Hunter, author of the definitive story of MtGox, Ultimate Catastrophe – How MtGox Lost Half a Billion Dollars and Nearly Killed Bitcoin, remembers how the exchange was brought to its knees and, crucially, what questions remain unanswered a decade later.
Who Did It?
One of the key questions that still remains largely unknown is: who stole the coins? Over 809,000 BTC were stolen across six hacks during MtGox’s lifetime, and we only know of two names linked to one hack: Alexey Bilyuchenko and Aleksandr Verner, who are accused of being part of the Russian hacking group that compromised the exchange in September 2011 and, over the course of 18 months, stole and laundered 647,000 bitcoins from the exchange’s cold wallets.
In fact, Verner and Bilyuchenko have only been charged by US authorities with the laundering of the coins rather than the hack itself, which could suggest a lack of evidence against them on that charge.
Apart from these allegations, sealed in 2017 and made public in June last year, we have no idea who stole the remaining 162,000 BTC. 79,956 BTC remain in the 1Feex wallet where they were sent by the hackers in March 2011, while 77,500 stolen in September 2011 have never been traced. This hack was so successful it was not detected until 2015.
Then there’s the individual who sent the value of Bitcoin crashing from $17.50 to $0.01 and stole 2,000 BTC in June 2011, and the individual who the month before swiped 300,000 BTC, more than half the coins held by the exchange at the time, when MtGox CEO Mark Karpelès left the wallet on a drive with unencrypted network access while carrying out maintenance. Fortunately for Karpelès the hacker got cold feet and negotiated a 1% bounty, leading to a loss of just 3,000 BTC for the exchange.
In all these cases we have no idea who did the deed, and it’s almost certain now that we never will. Many suspect the 1Feex hack was a dry run for the debilitating September 2011-January 2014 hack, given that the modus operandi was the same, but this has never been confirmed.
How Did it Happen?
Of the 881,865 BTC which left MtGox unintentionally, we can only say for sure how 72,409 BTC were lost: 30,000 BTC were logged as deposits to customers by MtGox’s system when they were in fact being stolen by hackers; an error by Mark Karpelès in October 2011 led to 2,609 being sent to a non-existent address; two bots operating on MtGox, Markus and Willy, lost 22,800 BTC; and Karpelès bought Polish exchange Bitomat for 17,000 BTC in July 2011.
When it comes to the hacks, the method of entry is generally either unknown or merely suspected. In the case of the June 2011 hack, we know that the hacker was able to get access to the MtGox server through an administrator-level account; this was initially attributed to “an auditor” but it was later revealed that it was the account of Jed McCaleb, the founder who had sold MtGox to Mark Karpelès, which inexplicably still had administrator privileges. It is thought that the hacker obtained the details when the entire MtGox user database was stolen along with the 79,956 BTC in the 1Feex hack.
Given that US authorities had enough evidence to claim that Verner and Bilyuchenko were part of a group that hacked into MtGox they must have some evidence to back up their assertions, but unless it ever comes to a trial (which is almost certainly never will) these details will likely never be divulged.
How Safe Were the MtGox Bitcoins?
Related to the question of how the hackers gained access to the MtGox servers is the question of how they were then able to access the funds supposedly securely stored in cold wallets. We know that until the June 2011 hack, Karpelès kept users’ bitcoins in a haphazard manner across various physical and software wallets, which exacerbated the impact of the hacks and prolonged the cleanup.
Karpelès claims that this incident led him to incorporate a much more secure system: he split the coins across numerous paper wallets (he later said hundreds of pieces of paper were involved) and stashed them in bank vaults and safety deposit boxes around Tokyo. Therefore, if the hot wallet was stolen again, as it was for the 1Feex hack, the cold wallets should not be affected.
This seems safe enough in itself, but when it was revealed that the exchange’s cold wallets had indeed been ransacked between October 2011 and January 2014, many started to ask questions, including Bitcoin blogger and future General Partner at crypto investment firm Andreessen Horowitz, Arianna Simpson:
If you’re doing it right, the cold storage should not be accessible via the hot wallet, leak or no leak. That’s the whole point of separating the two.
So how were the cold wallets compromised? Karpelès has never confirmed the cold wallet-hot wallet setup at MtGox post-June 2011, potentially to avoid any lawsuits based on the mishandling of funds, but he has given hints in interviews that paint an inconsistent and at times illogical scenario.
The only way to safely top up a hot wallet with funds from a paper wallet is to go and get the paper wallet and execute a multi-step manual transaction on an ultra-secure network. This must be done every single time, which is of course entirely impractical for any Bitcoin exchange no matter what its size or trading volume. No MtGox staff member has reported seeing Mark Karpelès handling paper wallets, and indeed some prominent members of staff told me for Ultimate Catastrophe that they had only ever heard hot wallets mentioned, never cold wallets.
Was there, therefore, a system that automatically topped up the hot wallet from the cold wallets when it ran dry and vice versa? This seems to be the only feasible way in which the exchange could have operated, although it totally undermines the principles of a cold wallet system.
Did Mark Karpelès Know the Exchange Was Broke?
This is the $64,000 question that still divides opinion. Naturally, Karpelès insists that he didn’t know the exchange had been bled dry until he checked the cold wallets in mid-February 2014, but there are flaws with this claim. MtGox had started experiencing Bitcoin withdrawal issues as far back as August 2013, and yet Karpelès seems to have not once considered that a lack of coins in the wallets could be the problem for over six months. This is despite the exchange having been the victim of multiple hacks in its lifetime.
Karpelès was quick to blame the ‘transaction malleability’ bug when it emerged in early 2014 as the reason for the withdrawal issues, but this was known to require a tremendous amount of social engineering to pull off even a small theft. In an interview for a 2018 documentary about MtGox, Karpelès claimed to have a monitoring system that he said was working fine, hence why he didn’t suspect any losses.
This would appear to be his reason for not suspecting a hack, but if it existed then it wasn’t designed properly, which is indicative of the kind of mismanagement that plagued the exchange.
Needless to say, there are plenty who don’t believe that Karpelès only discovered the loss in February 2014 and claim that he not only knew well in advance but tried to use the two trading bots present on MtGox, Willy and Markus, to make up the loss. If this was Karpelès’ intention it backfired spectacularly: the pair lost 22,800 BTC and $51.6 million between them.
The simple answer is that we can only speculate as to how the bitcoins on MtGox were secured, and unless Mark Karpelès deigns to tell us it will remain that way.
