Mt. Gox Collapse: How the World's Largest Bitcoin Exchange Lost 850,000 BTC (2014)

Mt. Gox, which at its peak handled around 70% of all bitcoin trading, halted withdrawals on February 7, 2014 and filed for civil rehabilitation in Tokyo on February 28, reporting that roughly 850,000 BTC had disappeared — about 750,000 belonging to customers and 100,000 to the company, worth approximately $473 million at the time. Around 200,000 BTC were later found in an old wallet.

1. From Card Trading Site to the Center of the Bitcoin Market

• Event Background: The domain mtgox.com was registered by programmer Jed McCaleb in 2007 for "Magic: The Gathering Online Exchange," a card trading service. The idea was abandoned, and in July 2010 McCaleb repurposed the domain into a bitcoin exchange — one of the first places anyone could buy bitcoin with a bank transfer.
• Event Details: McCaleb sold the exchange to Mark Karpelès, a French developer living in Tokyo, in March 2011. Under Karpelès the site grew explosively alongside Bitcoin itself, and by 2013 it was processing something on the order of 70% of global bitcoin transactions. The company remained a small operation: a handful of staff, no formal accounting system for its bitcoin holdings, and source code that Karpelès controlled personally.
• Technical Architecture Innovation:
  • The first real exchange stack: Mt. Gox had to invent order matching, fiat rails, and hot and cold wallet management for an asset with no precedent. Much of what later exchanges standardized was first attempted, imperfectly, here.
  • Custody without reserves accounting: The exchange never ran a reliable internal ledger reconciling customer balances against coins actually held. Nobody outside could check either, since proof-of-reserves did not yet exist as a practice.
• Direct Impact: A single Tokyo company became the price-setting venue for the entire asset class. When Mt. Gox went down for maintenance, the global bitcoin price paused with it.
• Long-term Significance:
  • Concentration risk, demonstrated: The industry learned that a decentralized protocol can still have a single, fragile point of failure at the market layer.
  • A warning that had already fired once: In June 2011 an attacker used a compromised auditor account to crash the Mt. Gox price to $0.01 in minutes. The exchange rolled back trades and continued operating largely unchanged.
• Lessons Learned: Decentralization at the protocol layer says nothing about concentration at the exchange layer, which is where users actually keep their money.
• Subsequent Development: By 2013 Mt. Gox was already under pressure: US authorities seized more than $5 million from its Dwolla account in May 2013 over money transmitter registration, and a lawsuit from former partner CoinLab was pending.

2. The Slow Theft, 2011 to 2013

• Event Background: The collapse is usually described as a single hack. The forensic record describes something slower and harder to notice: a leak that ran for more than two years.
• Event Details: In April 2015, Tokyo security firm WizSec published an analysis concluding that most or all of the missing bitcoin had been stolen directly from Mt. Gox's hot wallet over time, beginning in late 2011. Coins were drained gradually while the exchange's internal accounting continued to show balances that no longer existed. The shortfall grew for years before anyone at the company appears to have understood its size.
• Technical Architecture Innovation:
  • Hot wallet exposure: An exchange must keep some coins online to process withdrawals. Mt. Gox kept far more than necessary accessible, and had no automated reconciliation that would have flagged the divergence between recorded and actual balances.
  • No cold storage discipline: Later industry practice — multisignature cold storage, withdrawal whitelists, daily reconciliation, third-party attestations — largely codifies the specific controls Mt. Gox lacked.
• Direct Impact: By the time withdrawals were halted in 2014, the coins were long gone. Nothing that happened in February could have recovered them.
• Long-term Significance:
  • Insolvency can be invisible: An exchange can process withdrawals normally for years while deeply insolvent, as long as inflows exceed outflows. The same dynamic appeared again in 2022.
  • The case for proof of reserves: Mt. Gox is the origin of the industry's proof-of-reserves debate, which resurfaced with force after FTX.
• Lessons Learned: The dangerous failure is not the dramatic breach but the one that leaves the interface working.
• Subsequent Development: In 2017, Alexander Vinnik was arrested in Greece and later charged in connection with laundering proceeds through the BTC-e exchange, including coins traced by investigators to the Mt. Gox theft. He was convicted in France in 2020 on a money laundering charge and later extradited to the United States, where he pleaded guilty in 2024 to a money laundering conspiracy charge.

3. February 2014: Twenty-One Days to Bankruptcy

• Event Background: Customers had complained about slow withdrawals for months. The company blamed banking partners and technical issues.
• Event Details: On February 7, 2014, Mt. Gox suspended all bitcoin withdrawals, saying it needed the system "in a static state" to diagnose a problem. On February 10 it issued a statement blaming transaction malleability, a known quirk of the Bitcoin protocol. On February 24 the exchange halted all trading and its website went blank; a leaked internal crisis document circulating that day claimed 744,408 BTC had been lost to a theft that went undetected for years. On February 28, 2014, Mt. Gox filed for civil rehabilitation at the Tokyo District Court, reporting liabilities of about ¥6.5 billion against ¥3.84 billion in assets, and stating that approximately 750,000 customer bitcoin and 100,000 of its own had disappeared. On March 9 it filed for Chapter 15 protection in the United States. On March 20, the company announced it had found 199,999.99 BTC in an old wallet format used before June 2011, reducing the net loss from 850,000 to about 650,000 BTC. On April 24, the Tokyo court converted the case into bankruptcy proceedings and appointed attorney Nobuaki Kobayashi as trustee.
• Technical Architecture Innovation:
  • The rediscovered 200,000 BTC: The recovered coins sat in wallet files the company had stopped using in 2011 and had apparently forgotten. That an exchange could lose track of 200,000 BTC in its own possession says more about its controls than any external attack could.
  • Two different loss figures: The commonly cited numbers are 850,000 BTC (gross, as reported at filing) and 650,000 BTC (net, after the March recovery). Both are correct; they measure different things, which is why sources appear to disagree.
• Direct Impact: The bitcoin price fell roughly by half over the surrounding weeks, from above $800 in early February to under $450 by the end of the month, and tens of thousands of creditors were left holding claims against a company with nothing to pay them.
• Long-term Significance:
  • The industry's first systemic failure: Mt. Gox is the reference point against which every later exchange collapse is measured.
  • Regulatory acceleration in Japan: The failure led directly to Japan's 2016 amendments to the Payment Services Act, making it one of the first countries to license crypto exchanges.
• Lessons Learned: "Not your keys, not your coins" entered the vocabulary as a description of a specific, observed loss rather than as ideology.
• Subsequent Development: Karpelès was arrested in Japan in August 2015. On March 15, 2019 the Tokyo District Court found him guilty of tampering with electronic records and sentenced him to two years and six months, suspended for four years; he was acquitted of embezzlement and breach of trust.

4. Transaction Malleability: The Explanation That Did Not Hold

• Event Background: Mt. Gox's public account of the disaster pointed at a flaw in Bitcoin itself. Understanding why that explanation failed requires understanding what the flaw actually was.
• Event Details: Before SegWit, a Bitcoin transaction's identifier was a hash computed over data that included the signature. Signature encoding could be altered slightly without invalidating the signature, producing a different transaction ID for an economically identical transaction. If an exchange tracked withdrawals only by transaction ID, a mutated version confirming on-chain could make the exchange believe its payment had failed — and pay again.
• Technical Architecture Innovation:
  • Why it was Mt. Gox's bug, not Bitcoin's: The malleability quirk was known and documented years earlier. Correctly written exchange software confirms payments by monitoring outputs and balances, not by assuming a transaction ID is immutable. Other exchanges handled it without incident.
  • The scale did not add up: A 2014 study by Christian Decker and Roger Wattenhofer analyzed the entire chain and concluded that malleability attacks could account for at most a few hundred BTC lost by Mt. Gox before its shutdown, and on the order of 1,800 BTC across all such attacks. That is three orders of magnitude short of 650,000.
  • The fix arrived years later: SegWit, activated in August 2017, removed witness data from the transaction ID calculation and eliminated the class of bug entirely.
• Direct Impact: The malleability story briefly shifted blame from the exchange to the protocol. Independent analysis reversed that within months, and the WizSec findings established the hot wallet theft as the actual cause.
• Long-term Significance:
  • A durable myth: "Mt. Gox was hacked through transaction malleability" remains one of the most repeated inaccuracies in crypto history.
  • A real protocol improvement anyway: The episode raised the priority of fixing malleability, which mattered later because Lightning Network channels require non-malleable transaction IDs to work safely.
• Lessons Learned: When a failing institution names a technical culprit, the claim deserves the same scrutiny as its balance sheet.
• Subsequent Development: Malleability's elimination in SegWit became a foundational prerequisite for second-layer payment channels, an outcome unrelated to Mt. Gox but accelerated by it.

5. A Decade of Claims: What Creditors Actually Recovered

• Event Background: Mt. Gox's bankruptcy produced an unusual problem. The estate's assets were denominated in an asset that appreciated enormously while the case was pending.
• Event Details: Under Japanese bankruptcy law, creditor claims were fixed in yen at 2014 prices — around $483 per bitcoin. Because the trustee held roughly 200,000 BTC that had risen many times in value, a straight bankruptcy would have paid creditors their 2014 dollar value and returned the enormous surplus to shareholders. In June 2018, after a creditor petition, the Tokyo court converted the case back into civil rehabilitation, allowing distributions in bitcoin and bitcoin cash instead. The rehabilitation plan was approved in 2021, and the trustee began repaying creditors in kind in July 2024, with payments made on July 5 and July 16 to over 13,000 creditors through designated exchanges. The repayment deadline has been extended, most recently to October 31, 2026.
• Technical Architecture Innovation:
  • In-kind repayment as precedent: Distributing bitcoin rather than its 2014 cash equivalent was a novel resolution to the problem of a bankruptcy estate whose assets outgrew its liabilities. Later cases have cited the structure.
• Direct Impact: Creditors who waited a decade received bitcoin whose market value far exceeded their original claims, even though they recovered only a fraction of the coins they had deposited.
• Long-term Significance:
  • Recovery is not restitution: The trustee distributed on the order of 140,000 BTC — roughly a fifth of the customer coins originally deposited — plus the appreciation on what survived. The 650,000 BTC net shortfall has never been recovered.
  • The longest-running case in the industry: More than twelve years after the filing, the Mt. Gox estate is still distributing assets, which sets realistic expectations for how long crypto insolvencies take.
• Lessons Learned: Bankruptcy law was not written for assets that appreciate a hundredfold during proceedings, and the resulting improvisation shaped every later crypto insolvency.
• Subsequent Development: The FTX and Celsius estates both wrestled with the same petition-date valuation question, and both cited the Mt. Gox experience in arguments over whether creditors should be paid in kind or in dollars.