Topic: Gross Incompetence - What Really Happened at MtGox (Read 1219 times)

May 2, 2013 – Empty Gox was sued by CoinLab for 75 million USD for breach of contract. For unknown reasons, Gox failed to fulfill obligations to provide server access, resulting in a startup-crushing financial liability for failing to deliver. (Rob Banagale)

(Interestingly, there’s a massive selloff of 750,000 coins at an average price of about 100, totalling $75M, just following this event, suggesting customer coins were fraudulently sold to cover Gox liabilities. However, such a move wouldn’t make sense from a funding perspective, as it doesn’t change the amount customers have deposited in the exchange – if there was $75M deposited already, that could be used directly without a selloff; if there wasn’t, it would not magically appear because Gox sold customers’ coins on their own exchange.)

And this is the guy whom 90% of Bitcoin users trust their money to...  

MagicalTux fucks up... AGAIN!  

What will happen when they lose the income of 10 years?  

...

MtGox had other issues which resulted in payments failing, being delayed, and needing to be resent.  The attackers took advantage of this to "camouflage" their actions.  Your right if you send out payments to 50,000 users and 49,999 report no issue but one user over and over reports not getting paid well then "hmm maybe this user is running a scam" however if you send payments to 50,000 users and 30,000 of them report non-payment due to a variety of reasons (caused by Gox) then it becomes easier for the attacker to hide.

MtGox wrote their own client, and they did so horribly bad.   Their client isn't worthy of being used by a hobbyist experimenting on testnet but they used it in production for a systme involving millions of dollars of assets.  We have no idea how many things they got wrong but looking at the failed transaction we know at a minimum these things were wrong:

a) MtGox double spent their own coins.
b) MtGox paid insufficient fees on tx which were low priority meaning they would not be relayed to miners by most nodes.
c) MtGox created tx which violated the "anti-spam" rules which caused tx to be dropped (not relayed) by some nodes.
d) MtGox attempted to spend immature newly mined coins (newly mined coins can't be spent for 120 blocks).
e) MtGox used non-canonical signatures on transactions which were rejected by newer nodes.

and

f) MtGox failed to account for mutable hashes.


Now if MtGox had done a through e they wouldn't have lost any coins.  Yes users would be delayed.  Yes it would make them look foolish but had they at least done f right they would have not paid attackers twice.

On the other had if MtGox had done a through e right but messed up f, then your scenario in the OP would be correct.  Legit users would have seen no issue, attackers would have gotten double paid. ...

However MtGox managed to get a through f wrong so legit users were affected AND attackers were able to trick them into making double payments.   Worse the two issues compound on each other.  If the attackers were the only ones reporting non-payment then it is likely MtGox would have gotten suspicious relatively quickly however since this has been going on for the better part of a month and involves tens of thousands of transactions who knows how many times attackers were able to get away with a double payment.

...  I consider myself moderately knowledgeable about bitcoin, and I don't use a custom bitcoin client.  I use a custom backend which communicates with the reference client (i.e. bitcoind) for these exact reasons.   MtGox's attempt to build a custom client would be laughably bad if released as an open source alternative client with a warning to be used for testing only.  The fact that it was used as a closed source production client borders on criminal negligence.