Incident Overview
Mt. Gox Bitcoin exchange suffered a massive breach resulting in the theft of 25,000 BTC (US$400,000 at the time) from 478 accounts, affecting accounts with the equivalent of more than $8,750,000.
The incident began on 13 June 2011, when Mt. Gox reported the theft of 25,000 BTC from 478 accounts. On 17 June, Mt.
Gox's user database was leaked for sale to pastebin, signed by ~cRazIeStinGeR~ and tied to [email protected]. The theft continued throughout that day. On 19 June, a hacker allegedly used credentials from a Mt.
Gox auditor's compromised computer to transfer a large number of bitcoins illegally to himself, causing the nominal price of a bitcoin to fraudulently drop to one cent on the Mt. Gox exchange. The hacker used the exchange's software to sell all the bitcoins nominally, creating a massive "ask" order at any price.
The price corrected to its correct user-traded value within minutes.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Mt. Gox, these are the critical security checks that could have prevented this incident (June 2011).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Mt. Gox
The Mt. Gox hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.