What happened
Mt. Gox, then the largest Bitcoin exchange, halted Bitcoin withdrawals on 7 February 2014 and filed for bankruptcy protection in Tokyo on 28 February, reporting about 750,000 customer BTC and about 100,000 of its own BTC missing, worth roughly $470 million at the time. On 20 March 2014 it found 199,999.99 BTC in an old wallet, cutting the shortfall to about 650,000 BTC. Mt. Gox blamed transaction malleability, but later investigation by the security firm WizSec showed that the hot wallet's private keys had been stolen in September 2011 and the wallet was drained over roughly two years without the exchange noticing.
In June 2023 the US Justice Department charged two Russian nationals, Alexey Bilyuchenko and Aleksandr Verner, with laundering about 647,000 BTC from the hack through addresses at two other exchanges (one of which received over 300,000 BTC) and a Mt. Gox account. These are charges, not convictions.
How it happened
- Around September 2011 the attackers got access to a Mt. Gox server and copied the hot wallet's
wallet.datfile, which held the private keys for the exchange's hot wallet addresses. - Because the copied keypool also covered addresses Mt. Gox kept issuing later, the attackers could spend coins already in the wallet and new deposits sent to those addresses.
- Over the following months they repeatedly withdrew whatever the stolen keys could spend. By mid-2013 about 630,000 BTC had been taken (WizSec's estimate). Mt. Gox's own accounting misread some of these outflows as deposits and credited user accounts, widening the gap by about 40,000 BTC.
- According to the DOJ charges, the stolen coins were sent to addresses at two other cryptocurrency exchanges, one of which received over 300,000 BTC, and to a Mt. Gox user account. The charging papers do not name the exchanges.
- Mt. Gox did not reconcile its on-chain holdings against customer balances, so the shortfall went unnoticed until withdrawals were halted in February 2014 and the exchange went insolvent.
Protocol details
Evidence
- report Report coindesk.com
- report Report reuters.com
- report MtGox bankruptcy trustee report under Article 157 mtgox.com
- analysis DeFiLlama defillama.com
- analysis MtGox announcement regarding missing bitcoins mtgox.com
- analysis MtGox balance announcement mtgox.com
- analysis GAO-14-496 Virtual Currencies gao.gov
- analysis Russian Nationals Charged With Hacking One Cryptocurrency Exchange and Illicitly Operating Another justice.gov
- analysis Breaking open the MtGox case, part 1 blog.wizsec.jp
- analysis Russian Nationals Charged With Hacking One Cryptocurrency Exchange And Illicitly Operating Another secretservice.gov
- analysis Mt. Gox en.wikipedia.org
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
