Topic: New report on Mt Gox’s missing bitcoins (Read 1335 times)

There were a lot of articles linking the suspicious timing of bitcoins disappearing and the bots, Willy & Marcus, dragging up the price. If this is true, then thankfully the 2 events are unrelated. Mt Gox's bitcoins had disappeared far before Willy & Marcus made an entrance.

I have been wondering about these issues also. As I recall, the main trading engine was replaced after the crash in 2013. Prior to that time, was the exchange using the Satoshi client for a backend? (Thus slow RPC calls and easily overloaded.)

Speculation here, but what if during the 2011 hack or its recovery, someone obtained a copy of the wallet files corresponding to the hot wallets? Rather than simply stealing all the BTC in the hot wallet at that time, they realized that they could now predict the future wallet addresses and private keys that would be used by the exchange. You could perhaps generate the sequence of keys, since it is a pseudo-random number generator, and watch the blockchain for when the addresses accumulated enough bitcoin. Then use the private keys to transfer bitcoin to other addresses.

Under this scenario, you don't have to have continuing access to the exchange. And MK may have thought the old hot wallet files didn't matter since the old addresses wouldn't have balances anymore.

The fact that blocks of 100 BTC or other denominations were moved onto other exchanges, and even Mt. Gox, does suggest it may be possible for law enforcement, with subpoena power, to figure out who controlled those accounts and where the cash went on subsequent withdrawal.

All of these problems would have been caught early on by consistent reconciliation of the book balance of BTC against the wallet balances on the blockchain. This is like Finance 101, but it appears that MK did not do this simple step, which would have caught the losses at a much earlier stage.

Yeah, I didn't think you were accusing McCaleb of stealing the coins. I was just pointing out that the evidence exonerates him from being the one responsible since he had nothing to do with the exchange when the coins started to go missing.


That's only true for the second half of the chart since it suggests that the majority of the coins were lost/stolen in a short period of time early on.

This is similar to a case in the fiat banking sector, where a employee took a few cents from millions of accounts over a long period. These transactions never raised any flags, because nobody cared about a few cents.

After a few years these cents accumalated to a few million dollars and the employee were caught when he tried to withdraw the funds. {The withdraw limits, raised the red flags}

People tend to be very creative, when it comes to stealing someone else's money. 

Read my post again. I wasn't accusing McCaleb of stealing the coins. He is a honest man. Karpeles was the one who stole the coins. He just waited for 3-4 months before stealing them. That's all.

There are probably too many people keeping their eye on Karpeles and analyzing his every move for him to realistically cash out that much BTC whilst still going unnoticed.


According to the chart, there is still a good 3-4 months between the sale to Karpeles and before the coins started to go missing. It does show that McCaleb probably didn't have anything to do with the collapse though.

Also, this was around the same time when Bitcoin was just starting to get noticed by the mainstream. Not sure if it's related or not but it's kinda interesting to note.

EDIT: And I think there was a major code rewrite at around the time it was sold too.


There was also the hack that happened in June 2011 as well which was what led to the 424,242 BTC transfer in the first place. I wonder if it's related.

For me this looks straight and simple.

Jed McCaleb sold Mt Gox to Mark Karpelès on 6 March 2011. The Bitcoins started missing soon afterwards. For me this is clear. Karpelès purchased the exchange, so that he could steal the coins from its users. And he started doing that immediately after he purchased the exchange.

Could it be possible that they forgot about the June 2011 424,242 BTC transfer?

Not only do the lines diverge immediately after the transfer, but if you look at the period right after the July-November gap, the difference between the "expected BTC" and "actual BTC" is roughly 400,000 BTC as well.

Well, to a certain degree. If the coins were mixed properly and sent to BTC-e and other exchanges a relatively long time before Gox went belly-up, then people may indeed have been lucky and successful in hiding their identity... Oh and if this was Karpeles, he would be sipping a Frappuccino, of course!

Mark Karpeles acted alone, had partners in crime, or is a patsy for someone with an "interesting" agenda?

it looks the problem had been around for a long long very time

Hmm... I superimposed the two lines together after July 2012 and this is what I got:



So it looks like there was a tiny trickle of coins still being slowly lost after July 2012 but most of the damage appears to have taken place between July 2011 and July 2012. After around early-mid 2013, the lines are almost perfectly aligned.


I'm not sure if it would be possible to hide that much money. Mixing probably wouldn't work since the amounts involved are so large. I remember someone tried to mix a ton of stolen coins through Bitmixer and it didn't work because the coins that came out were still 99% his.

And because of this, trying to convert the coins into fiat would risk exposing the culprit's identity. If whoever is responsible kept most of it in cold storage and mixed their coins in small batches then it could conceivably work although it would take a very long time. Techniques of analyzing the blockchain are getting better and any developments in the field can be applied retroactively so the thief will always need to stay one step ahead to avoid being caught.

And that's assuming that the thief isn't Mark Karpeles or someone closely associated with Mt. Gox. If they were, then any attempt to cash out the stolen coins would be instantly noticeable and I doubt they would be so dumb to even attempt it.

If this is true and most funds had been stolen/missing since 2011, there is no doubt in my mind that Karpeles knew he was running an exchange on fractional reserve banking. I mean how would you just not know that most of your funds weren't there? When doing accounting and routine cold wallet deposits, if such a large chunk is missing you're either going to know that You or Your People have safely stored that money away or you're going to know that it's gone.

I also give props to WizSec for all of the time and energy they've put into working the Mt. Gox incident. 2 million addresses accounted for that is quite a bit!

With this new data it seems that MtGox run for one or two years like a ponzi company. In my opinion Mark Karpeles knew about the MtGox bankrupt situation from the beginning.

Whoever has stolen or hidden these Bitcoins are easy to hide their entire life time as they are protected by the anonymity that the Bitcoin gives. The person right now might be roaming in some beach sipping a juice with the bitcoins safely secured in his/her cold storage.

Seems legit, Karpeles probably had no idea.   

Another link to article here: http://blog.wizsec.jp/2015/04/the-missing-mtgox-bitcoins.html

Kudos to the folks putting in the long hours sorting through all this data.

I believe the description is accurate. Looking at the graph, the gap keeps getting wider. So, coins were consistently being stolen in small amounts over a long period of time. The most severe period is Jul 2011 to Jul 2012.

I don't really think that the lost coins are the main reason for the bear trend, but rather really the Willy Bot, as cruel as this may sound. If those coins never existed or already disappeared starting 2012, they would've actually created selling pressure on the markets!!!

Getting back those 200k bitcoins is important to me, i hope kraken succeed in their predicting end of year for payments.  What a shitty situation probably 50% of reason for bear trend.