Mt. Gox Hack

Reported loss $8.8M
Bitcoin
Other

What happened

On June 19, 2011, an attacker broke into Mt. Gox, then the largest bitcoin exchange, and crashed its bitcoin price to $0.01. According to reports at the time, the attacker used credentials taken from a Mt. Gox auditor's compromised computer to reach an account with administrator-level access. From that account they created a huge amount of BTC on the exchange's books and dumped it with a sell order at any price. They then bought the now-cheap BTC with their own accounts and withdrew about 2,000 BTC. Bitcoin Wiki records another 643.27 BTC withdrawn during the crash; MarketsWiki says other customers bought about 650 BTC at the low prices and never returned them. The price returned to its normal level within minutes. Accounts holding the equivalent of more than $8.75 million were affected.

The breach also leaked the exchange's user database, with usernames and hashed passwords. Weaker passwords from it were later used in other thefts. On June 23, Mt. Gox moved 424,242 BTC in block 132749 to show it still controlled customer funds. Later investigation suggested those coins may never have been in cold storage.

How it happened

  1. The attacker obtained credentials from a compromised computer belonging to a Mt. Gox auditor, which gave them an account with administrator-level access.
  2. Using that access, they credited a very large amount of BTC to the exchange's internal books and placed it in a sell order at any price, driving the Mt. Gox price down to $0.01.
  3. With their own accounts, they bought BTC at the collapsed price and withdrew about 2,000 BTC. About 643 more BTC bought at crash prices also left the exchange.
  4. The price recovered within minutes, and the leaked user database, with usernames and hashed passwords, was later used to break into accounts elsewhere.

Protocol details

Classification CeFi / Access Control
Protocol Type Exploit/Other
Protocol links Website

Understand the attack patterns

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.