Bitcoin Forum

Official response regarding the shenanigans at Mt. Gox from our chum Gavin Andresen.

https://bitcoinfoundation.org/blog/?p=418


There has been an update on this matter from Gavin Andresen - Feb 11 2014:-

Update on Transaction Malleability - https://bitcoinfoundation.org/blog/?p=422


Here is a post another forum member started in Press regarding this update:-  https://bitcointalk.org/index.php?topic=461125.0

This is highly ironic, with Mark being a board member...  ;D

Of course their wacky php custom wallet is not the problem, it's bitcoin's problem. Anybody remember MagicalTux's custom php ssh shitshow he posted to his blog? He doesn't understand rolling your own crypto (or raw transactions) leads to doom if you don't know what your'e doing. http://blog.magicaltux.net/2010/06/27/php-can-do-anything-what-about-some-ssh/

http://i1110.photobucket.com/albums/h451/silvercent/goxedagain.png

Pretty sure this needs to get addressed sooner than later.

I realize some things take time, but two years to fix a known bug is a wee bit excessive.

-B-

One could argue if this even remotely classifies as a "bug". It's not a problem whatsoever, if people wouldn't be so stupid to invent their own processing verification rules like MtGox did.

The Bitcoin Foundation pays Gavin to maintain the reference Bitcoin client.
Peter Vessenes is the Chairman of the Bitcoin Foundation, and the Founder of CoinLab.
MtGox (Mark Karpeles) is also a member of the Bitcoin Foundation.
Over the past 18 months or so, Gavin made a lot of changes to the Bitcoin protocol in a relatively short amount of time, including forcing a hard fork.  Many observers noted at the time that this was unwise.
CoinLab and MtGox are involved in some sort of lawsuit involving an agreement to transfer customers from MtGox to CoinLab.
MtGox appears to have been unable to keep up with the changes to the Bitcoin protocol.

Anything inaccurate about this assessment?  I'm trying to maintain a relatively neutral view of the facts, but that's difficult as a Foundation non-member, since the Foundation does everything in secret.  So if anything is mistaken please let me know.

But, beyond just the obvious facts, would anyone like to discuss the obvious clusterfuck of interests going on here?  Should I even mention BitInstant?

I guess it depends on the programmers working on it. :D

Known by whom?

Where is the list of all known Bitcoin issues that I can access and view freely? written in plain non-technical language so that anyone about to invest money into Bitcoin can familiarize themselves with the potential risks?

I called it, last night I was telling some folks that gox's response will be "it's not fault this happened".... sure enough they come out saying it's not their fault.  Gox always does this when something goes wrong,  it's never anything wrong on their end but always something out of their control that causes the problems.

Hopefully in the next 6-12 months gox will be a thing of the past.  They played their role in the btc community especially early on but it's become apparent that under their current management gox isn't fit to be a bitcoin exchange and we need exchanges that are more capable of delivering the demands of a bitcoin exchange.

https://en.bitcoin.it/wiki/Transaction_Malleability

Follow the references.

You say that like it should be somebody's responsibility to provide you with it?

You say that like it shouldn't be somebody's responsibility to provide me with it?

Cliff Notes:

Contrary to Mt. Gox’s Statement, Bitcoin is not at fault _{-Gavin Andresen, Feb 10 2014}

Added Jan 2013.

That's what I was thinking. Bug or weakness, this "Foundation" should have realised that billions of money is at stake. Everywhere you go they warn about safety first, be careful for malware, key-logging, etc. Why would anyone trust any Bitcoin-exchange, where wallets are controlled by third-parties anyway, even worse, they are managed by amateurish clowns !? Now, "empty cocks" is throwing mud and hits Bitcoin in their weakest spot.

Maybe this was discussed somewhere else but could this be something Gox came up with to buy them time. There are a lot of people who are questioning their liquidity. I doubt they will cut and run because they are too big for that. So maybe they are just coming up with an excuse while they try to solve their money problems.

As Gavin and many others have said...this is not a new fault. Its been openly discussed for years now. So why is Gox suddenly having problems now when nobody else is?

It's not.  It's called due diligence.  Everyone has to due (:P) their own.

Uhhhh no it shouldn't be. You have google and an active internet connection you can find it for yourself. I know for a fact i've seen about a hundred articles on this site alone about a 51% attack and blockchain size...

we all know its MTGox's custom scripts that are at fault more so then blaiming bitcoin.

we know this because bitcoin is stored on private keys, and if it was a bitcoin issue, we would all have it. so its a local problem with his system. and the solution is simple.

delete the script and make a new script that connects to the members database and client. theres no need to waste weeks debugging dodgy code that has hundreds of functions for the entire service. when a simple withdraw script will do the trick

Gox just doesn't want to accept blame for their shit code.

the community nominates:.................................................... dramatic pause

whtchocla7e to find all the information, translate it into laymans terms, and then distribute it to HIS investors. but just one piece of advice, by the time you found such information, the solution is normally found and the so called risk becomes theoretical.

Of course Bitcoin is not at fault.
Oh Gox..

This highlights the biggest problem for Bitcoin of FUD and how easy it is for people like whtchocla7e to get involved in something without doing due diligence.

With MTGox blaming anyone and everyone other than themselves, and far too many people being unaware of the other exchanges, this action is going to do a lot of damage to Bitcoin in the short term.

Maybe it might be an idea to see MTGox being removed from the foundation until they can prove that they are worthy of such a coveted position within the community?

It would also be a good way to demonstrate how the foundation is able to differentiate between personal and professional bitcoin interests ;-)

I think Gox has had ample time to prove themselves. They've proven something alright. They've proven that they are a cancer and that cancer should be removed before it can do any more damage.

I started a separate topic by mistake, so I'll repost it here:

Thanks for refocusing on this post.
The problem is not "why is it not done yet", but more "why is it more urgent than taking care of bitcoin's ability to handle much larger transaction volume"?

The answer is simple.

It's on the same level as
"why is this label text still purple when it should be blue"

vs

"why is this label text stating..."
instead of

i say we demand manual withdraws or heads start rolling, fuck this shit guys

What could be at fault too, is that many people have misunderstood the role of exchanges. They're not banks. Nobody should leave its BTC there. People should buy BTC through an exchange and once the transaction is done, they should move away, sending immediately their BTC to their own wallet in their home computer.

Gox is not ashamed to throw dirt at BTC to divert blame from themselves pulling the market down 20% in the process, this is revolting  >:(

Certainly it is also the bank's fault that fiat isn't flowing either  ::)

That seems like a 1.0 feature to me. Addressing transaction malleability, on the other hand, could fit just fine in the 0.x.x roadmap. Nobody (at least to my knowledge) said anything about fixing it overnight.

I'm not saying Mt. Gox are the good guys here (they clearly screwed up), but shouldn't Gavin Andresen have accepted some responsibility?

Responsibility for MtGox choosing to willingly donate coins to people asking for them to their support team?
Let me think....
Err, no.

The software is Open Source and many people donate time for no pay. "Responsibility" depends on who has the time/skill to do/fix things.

how long before the Japanese start waiting outside MtGox everyday

italian, swedish or texan people will probably beat the japanese to it.
Oh wait.
You know MtGox is not a japanese company, right?

Riiiiight. They're only based in Tokyo. Definitely not a Japanese company.

The Texan people probably won't get past airport security (with their firearms and all)...

They have offices in japan, fuck this guys its time to apply some pressure, gox CEO has over 300k BTC he can pay until they sort their shit out.

We need to team up with some locals

Guess who came up with the idea to use the txid for auditing/tracking in the first place .. https://bitcointalk.org/index.php?topic=807.0

There are plenty of known issues with Bitcoin, some of them more or less serious.  This, frankly, is one of the less serious issues, since it only arises when people design custom software very, very badly.  Gox and its principals were well aware of this particular issue, having been told about it personally, but chose to design defective software.  This wasn't even accidental.

The problem is, if I'm understanding it reduced to its simplest level, relying on transaction information that is NOT YET ON THE BLOCKCHAIN.  It kind of boggles my mind anyone could base any reliance for verifying deposits to a system on anything whatsoever not on the blockchain, even for tracking purposes.

It's clearly non-optimal to use this information at all, but the downside of it could have been very easily avoided.  I hope no other exchanges operate this way, but I honestly don't know.

In 2010.  If I recall correctly 2010 is before 2011.

Not only relying on information that is not yet in the blockchain, but also not paying attention to relevant information in the blockchain because you think you preliminary information is canonical.

So the transaction malleability problem was created in 2010 and reported in 2011.

No.

Transactions have always been malleable prior to being included in a block. This wasn't really apparent until 2011.

There's nothing wrong with txid, the only problem is inaccurately assuming that it's immutable, and especially not noticing when changes to the blockchain affect your balance in ways you weren't expecting.

Maybe they were, but this certainly didn't help:

That's the part Mt Gox missed.

In order to do this you've actually got to pay attention to the network to make sure that what you think it's going to do is actually what it does.

They fucked up by assuming that if the txid they sent didn't make it into a block, then no other txid could have spent those coins so they didn't bother checking the blockchain to make sure that was the case.

Where's the part of that where he says "then, after returning the txid, depend on it as a permanent identification proving a deposit into an exchange?"  I'm not seeing that.  There's really nothing more fundamental to Bitcoin than the blockchain, and that if something is on it, you can trust it forevermore after whatever number of confirms makes you comfortable.  If it isn't, you can't, even if it might have some temporary use in the interim.

Wasn't that a reasonable conclusion from sendtoaddress being updated to return a txid?

Not when they had been personally told otherwise.

No.

Only the blockchain is canonical.

It's been that way since day 1. If you're implementing a wallet you already have to account for the fact that the blockchain can change during a reorg, so you should already be constantly checking what you think you know according to what is actually true.

There's no excuse for not noticing that outputs you thought hadn't been spent yet have been included as inputs to a transaction in the blockchain just because you weren't expecting that txid.

I agree with the statement, however, I do believe this is something that should get addressed sooner rather than later.  been set aside too for too long

How could he? The flaw is in MtGox's closed-source implementation and customer service policies. Not Bitcoin.

OK, let's try a little experiment.

Suppose you're in charge of the London Underground, and you're having the slight annoyance of an occasional passenger being run over by a train.

You could:

1. play a recording saying "Mind the gap" every ten seconds or
2. put a wall with sliding doors between the platform and the train.

Which one would you choose?

Well, then, let's get some broad consensus and running code out of the door to find your tx back in the chain reliably if that's all we need.

It does show the power of open source.  Had MtGox's "Gox Special Wallet" been an open source project it is very likely someone would have caught the numerous implementation errors.  Nobody knew except MtGox how incredibly flawed their wallet was, and they didn't have the competence to realize it was flawed.  I am not just talking about the tx hash malleability issue but a host of other flaws as well.

You're not listening. MtGox built their own subway with flawed doors. Only MtGox can fix those doors.

Yeah lol Gavin should be held responsible for something he didn't do.

Good luck with that.  ;D

Both…. same as they do in HK,
 because there is always some Deaf guy who cannot hear the announcements… then they have people standing by the walls to stop the mainlanders trying to force the doors open, and Security for the people like (gox) who flatly refuse to follow the rules

Oh, I am listening. The problem isn't with the doors (as far as we know). Had it been the doors, a wall wouldn't help.

Yes, that is the problem. Gox built their doors out of rice paper. People are walking right through them.

Gox has a flawed implementation. They allow customers who have already received a withdrawal to claim they didn't, and Gox will send them a new withdrawal!

Can someone explain how the malleability problem is manifest?

I thought Gox like other waited for 3x confirmations in the Blockchain before acknowledging transfers into or out of a Gox account?

Gox creates a withdrawal and makes note of the TXID. Then, before it is included in a block, someone else changes the transaction such that only the TXID changes, but the transaction is still the same. When the new TXID gets included in the blockchain, the customer who requested the withdrawal claims they never received it. But they actually did! Gox looks up the old TXID and doesn't find it, so they create a whole new transaction and send another withdrawal to the customer. The customer has now been paid twice!!! This is solely Gox's problem because they do not correctly track transactions.

To clarify further: in an transaction, only the inputs, the outputs and the amount are signed. The TXID is -not- signed, and thus can be changed by anybody while keeping the transaction valid. It is -not- a bug, it's a design choice. The Bitcoin protocol never stated that the TXID was to be unchangeable, and thus nobody should have expected that in their software.

One can uniquely track transactions otherwise. Even if the TXID is changes, the inputs are not. Thus one can know if a transaction went trough by checking if a given input has been spent according to the blockchain.

I wonder if all Mt. GOXXX threads will be moved to service discussion?  Hmmm... maybe just mine...

Hopefully not. Can't believe they don't audit their balances continiously/from time to time an discover such drains just in time.

Why can't you believe it?

Gox had a foolish way of checking whether people had been paid or not.  It's not inherently Bitcoin's fault that they did that.  It was clear that people would change transaction IDs so I really do think it was Gox that messed up.  Sure, Bitcoin and the Foundation can change it but it's not like BTC was inherently flawed.  It can be changed to make it easier in the future though.  But this selling, I do blame totally on Gox and I don't think you can disagree.

Suspension of other exchanges now for the same problem discredits Gavin's initial statement that the fault was all with Gox. 

Why do you feel that it's unlikely that two exchanges can't both do it wrong, independently?

Surely the fact that bitcoin-qt isn't affected lends weight to Gavin's statements?

Not really.  All of these businesses are trying to make Bitcoin into something it is not (yet) and most of them took more or less the same easy, and somewhat ignorant, road to doing so.

If anyone based their accounting on the potentially mutable tx-id they were either ignorant of it's nature, or just flat out ignorant.  Either of these mistakes calls into question their viability as a financial services business.  Big time.  They'd probably fail for some other reason if not this.

I'm just glad I stopped using Gox that last time I was "Goxxed" this past May. The hand writing has been on the wall since way before then. They need to die out before they do anymore damage to Bitcoin. How many times now has a crash, dip or negative Bitcoin media attention been preceded by some sort of Gox malfunction?

I think maybe somebody, other than me because I'm lazy, should go through the forums and tally up all the GOXXXings.  I can think of at LEAST 3 big ones off the top of my head but I know there were more.

There be update.

https://bitcoinfoundation.org/blog/?p=422

You are responsible for doing your own homework.  Nobody else is.

from Bitcoin Foundation:
Update on Transaction Malleability
Gavin Andresen    Feb 11 2014

You may have noticed that some exchanges have temporarily suspended withdrawals and wondering what’s going on or more importantly, what’s being done about it. You can be rest assured that we have identified the issue and are collectively and collaboratively working on a solution.
 
Somebody (or several somebodies) is taking advantage of the transaction malleability issue and relaying mutated versions of transactions. This is exposing bugs in both the reference implementation and some exchange’s software.
 
We (core dev team, developers at the exchanges, and even big mining pools) are creating workarounds and fixes right now. This is a denial-of-service attack; whoever is doing this is not stealing coins, but is succeeding in preventing some transactions from confirming. It’s important to note that DoS attacks do not affect people’s bitcoin wallets or funds.
 
Users of the reference implementation who are bitten by this bug may see their bitcoins “tied up” in unconfirmed transactions; we need to update the software to fix that bug, so when they upgrade those coins are returned to the wallet and are available to spend again. Only users who make multiple transactions in a short period of time will be affected.
 
As a result, exchanges are temporarily suspending withdrawals to protect customer funds and prevent funds from being misdirected.
 
Thanks for your patience. Follow us @BTCFoundation for updates as we learn more and make progress.




really interesting...  so MTGox was 100% right.

Also bitstamp.net temporarily suspended withdrawals...
https://www.bitstamp.net/article/bitcoin-withdraws-suspended/

Anyway, bitcoin foundation is working to find a quick and effective solution, so our bitcoins are safe ;)

As always on technology, the name of the game is "shit happens", and the subtitle is "the question is when, not if".

Hopefully some here will have learned a lesson: bitcoin is technology.

Technology is not about finger pointing or religious faith, it's about finding issues, fixing issues and moving everyone forward.

Everyone will mess up technology sooner or later, that's a fact, just like everyone will trip and fall someday.
Communities should be about helping those that fall get back on their feet, not kick them while they're down.

Great to see key proponents cooperating on this issue!

Why not sign the entire transaction including the TXID?

Sign it with which private key?  A tx can (and usually does) have multiple inputs.

Any random one? Even with thousands of inputs an attacker wouldn't be able to sign a mutated ID with any of the inputs.

Looking around I actually get the feeling that one of the reasons why this minor issue was left on the shelf was because there's so many different people with so many possible different solutions.

Any random one, doesn't really matter as long as it can't be changed and can be verified, no?

A "good practice" could be to use that of the first or last input (to speed up verification). The (non-compulsory) ordering could be done when submitting (by the wallet) or when mining the transaction (as a courtesy from miners).

Your BITCOINS have ALWAYS been safe.  What has not been safe, necessarily, is balances in exchanges, which are not actually Bitcoins, any more than your money in a bank is actually dollars.

Adding any new requirement would "break" the protocol. Changing the behavior of signature production/requiring a new field in the transaction indicating which input signed the txid, would make all old wallet/miners/clients/exchange software unoperative.

It would require forking the chain, because the blockchain does not actually contain that info. (I guess though the whole transaction signature might be dropped when the transaction is included in the chain; but then it would be only an "voluntary" rule enforced by miner to NOT include a mutated transaction by a third party.)

Anyway, such "breaking" behavior is generally undesirable. The devs were trying to come up with a unique "canonical" way to construct a transaction such as there is only ONE way to make a given transaction, so that the resulting txid is unique too. A pool recieving a non-canonical transaction would mutate it before inclusion. Software requiring specific txid would make sure of producing a canonical transaction.

That way we would introduce a new desirable behavior, without breaking anything.


In fact I feel it is EXACTLY that.

That, and that, any change cannot be made overnight. And requires a few month of developpement/testing/deployment before thinking of enforcing it. -> A very complicated process for a "non-bug", if people had read the specs and had not assumed txid were non-mutable.

(un)fortunately, the current crisis provides an opportunity to act much more quickly, because we already -do- have broken behavior, it can't get much worse. It can now be "spun" as a critical update that anybody must implement to continue to be able to use bitcoin.

There is always the possibility to create an alternative format and make it mandatory, starting with block 12345 some time in the future.

Obviously the clients would have to be able to process both the old format (before block 12345) and the new (block 12345 and beyond).

It is a fork, but it could be pre-announced well in time, if a large majority of miners agree.

Fundamentally, if the bitcoin algorithm could not be repaired and improved, it would die an early death.

Of course! Bitcoin has already done that a few time.

But even if the change makes total sense, and all miners agree to it, it is still something the devs try to avoid as much as possible. Because it renders all unupdated clients non-functionnal. One could say "they just had to update", but sometimes it is not easy. For example, I remember seeing a pool table which could accept bitoin payments to release the balls. It is embedded electronics. Updating that is not easy. In any case, it is bad PR to have some people's software break because of an update, even it is their own fault.

Thus the devs usually try to bunch such "breaking" changes in a single update to minimize the need for such updates, and only do it when a compelling problem requires it. The mutability problem had not been compelling enough before, but it is now.

I wonder. The question is whether it is possible to calculate something from the signed content that can serve as a new kind of transaction ID. If so, then the clients could be fixed just by following advice and changing only very little code, without having to change the basic bitcoin algorithm at all.

So, to sum it up

1. DDOS attack exploits bugs in exchange's custom software
2. Bitcoin already has a fix which will be rolled out soon which will save exchanges from their own shoddy coding
3. Bitcoin price dropped 40% due to panic
4. Bitcoin price will go back to normal once this is fixed in a few days
5. Because exchanges all suspended transactions I can't actually buy bitcoins at this massively reduced price :(

uh, you could just buy bitcoins and wait...

where can I buy bitcoins if the exchanges are down?

You can still buy your BTC with ya filthy paper, you just can't withdraw your BTC from a few exchanges at the moment. This will be sorted in the coming days.

Did MK read this update by GA or is he still going around spreading lies or is the media just regurgitating old news?

http://www.forbes.com/sites/leoking/2014/02/13/mt-gox-ceo-mark-karpeles-responds-to-widespread-bitcoin-criticism/ (http://www.forbes.com/sites/leoking/2014/02/13/mt-gox-ceo-mark-karpeles-responds-to-widespread-bitcoin-criticism/)


So it sounds to me like they put their customers flexibility (read: MtGox's bottom line) above the security and suitability of their software implementation and now try to blame the protocol for changing too quickly when transaction malleability was known about in the same year as the creation of their client.... in 2011!

How can you respond to criticism about lying by repeating the same lie... does he think we're all idiots?

Say, since supposedly the issue is with the exchange's implementation of their wallets and not with the protocol itself... is there any exchange not affected by this current issue?


Oh, I see now. Well I better buy some BTC then.

Looks like the attackers turned to Bitstamp once Gox suspended withdrawals?

Either way it is not really a bug; just a vulnerability from what I gather

Pretty much as if someone could change the comment field in a wire transfer: the wire would still arrive but it would cause confusion because the receiver could not easily assign the payment. If such a vulnerability is exploited by an attacker, could cause considerable damage to the entire ecosystem.

I wonder if this was done maliciously to get cheap BTC? On a bigger scale than just asking for double-withdrawals? A lot of big money is looking to get into crypto at the moment; it makes a big difference whether they enter at 600 or 900 ...   :o

This MTGOX Ceo is something else, from the same article -


Like they couldn't privately contact the other exchanges instead of releasing a statement purely designed to cause panic and give a nefarious entity (Maybe even GOX themselves) an attack vector to damage the Bitcoin network for a few days. 

Yeah, was going to mention that too: "We programmed crappy code, but identifying a bug we built in that crappy code helped others find the same bug in their crappy code and also helped others with proper code identify why our crappy code was causing problems on their systems... aren't we great (pats himself on the back)"... WOW!

If Bitcoin is not at fault, why are the Bitcoin developers working hard to fix the issue now... Yeah...  ::)

Gavin's comment is full of shit then, wow.

Satoshi must feel shit seeing Gavin mess up big time over and over again, this time majorly.

Obviously, because it is now a public relations issue.  So more compelling technical issues are being shunted aside to deal with this comparatively trivial issue because of Gox's actions.

Only because of Gox's fuckup and subsequent FUD has this difficult to fix but comparatively minor flaw suddenly become a priority, basically for PR reasons.

Because the value of their assets dropped 50% and will continue to drop unless the problem is fixed.
And they worry that mtgox is too incompetent to fix it themselves

The price has already stabilized, so far as I can tell.

Yes, but at what price? The Mt. Gox dollar price is only about 60% of the Bitstamp price.

Does this mean that many Gox customers believe the price will fall that far on the other exchanges before Gox gets their bitcoin transmission going again? Or does it mean that they believe their dollars are safer on Gox than their bitcoins? Or what? I find it difficult to explain the price difference.

I shared the situation with someone who held a cash balance in MtGox per my introduction to bitcoins awhile back, and he chose to buy bitcoins now.  He did the math and realized that in the end, a bitcoin is a bitcoin, whether you paid $400 or $700.   Plus, only hope he has of getting his money out is via BTC withdrawal anyway.  Even before this their international wires were backed up over 4 weeks.  

Who cares?  I can get the Bitstamp price.  The Gox price has been fictional for well over a year.  It needs to be disregarded utterly.

Not by those who have funds on Mt. Gox. And they are many. For them it is highly interesting to predict what will happen.

Last I looked the Mt. Gox dollar price was down to near 50% of the Bitstamp price.

I am wondering what this means. Apparently people are dumping bitcoin on Mt. Gox, although bitcoin withdrawals have in the past worked very much better than fiat withdrawals. Many seem to believe that Mt. Gox is giving up and will not re-enable bitcoin withdrawals.

So far I cannot follow this line of thinking. If Mt. Gox would not fix their bitcoin withdrawals within reasonable time, they would be signing their own death certificate. It would mean and become obvious that they are fraudulently stealing the funds, which could quite literally lead to some Mt. Gox people's death.

My personal guess is that Mt. Gox will get their bitcoin withdrawals going withing a week or two. This would mean some significant outflow of bitcoins, but it would not sound Mt. Gox's death knell.

I could imagine that, given Mt. Gox's limited programming skills, they would initially process bitcoin transmissions slowly, checking transactions manually, but they cannot hold up bitcoin transfers for long. The longer it takes, the more Mt. Gox's already deeply damaged reputation would suffer.

So my personal recommendation is, if you still have fiat on Mt. Gox, buy some bitcoins. Perhaps not with all your dollars, if that is your entire pension, but at least some, hoping for the likely outcome that you will be able to pull them out soon and sell them at a higher price somewhere else.

Of course, as that happens, the price on the other exchanges will fall somewhat, which could be reinforced by early selling by others who also foresee this. But that could be temporary and can possibly be counteracted by keeping your bitcoins for a couple of weeks or months, until the waves die down.

how can Gavin Anderson have any credibility, he too is on the Foundation board and it has TF's logo on it ?

The later.  MtGox doubled paid attackers for who knows how many times and this has could have been going on for a month.  How many Bitcoins does MtGox owe customers?  How many do they have?

Good point.  People who have funds on Gox probably do have an interest in that number.  I have a name for those people.  I call them "fools."

Greedy fools :)

Gox was never anything good for me.

The price on MtGox is $238, $634 on Bitstamp, $400 less!  There is a lot of speculation on why the price is so low.  Some speculate that everyone stuck in MtGox has been moving to cash.  That's possible.  But, the opposite is also possible.

If everyone buys BTC inside MtGox, eventually, you run out of buyers.  Let's imagine that very few have cash in MtGox.  Now, when someone tries to sell it, the price will drop, because the few who still have cash are not willing to buy at all or at least not buy unless it is cheap. 

In this scenario, if the majority possess BTC, and a small percent of them want to sell, you can still very easily have more people willing to sell than buy.  E.g., let's say 95% is in BTC, and 5% is in fiat.  if 10% of the BTC holders want to sell, that is still double the amount available in fiat. 

In short, MtGox is currently suffering a massive liquidity problems.  Since no one can buy or sell items with their currencies in MtGox, other than currency itself, you eventually run out of liquidity to support trading.  The price will naturally move to one extreme or another.  Previously, where liquidity was limited but you could still get money, especially BTC, in and out, the price was abnormally high due to the restraints on the fiat side.  Now, that BTC withdrawal is plugged, it is abnormally low. 

Add to this that those with fiat now have an incentive to wait to see how low the price will go.  Like a dutch auction, they are risking that opportunity being gone forever in the hopes they can get the best price. 
 

Does not sound right, because lots of people have fiat currency on Mt. Gox. Why? Because they cannot get it out.

I also find the Gox prices ridiculous. My explanation is that there are many users who are simply uninformed. They have not read the forums or the Mt. Gox announcements. They are panicking.

I guess we are hitting the bottom around now. I think the price cannot go down to $200 while it is $600 on the other exchanges. There must be some people with some reason who buy at prices below $250.

Moreover, Mt. Gox will issue another announcement tomorrow, which will influence the markets. If it sounds positive, like stating that bitcoin transfers will be switched on later this week, then the price on Mt. Gox will rise. The price on the other exchanges should fall somewhat, but perhaps these considerations are already partly reflected in today's price, which has gone down a bit over the last few days.

MtGox does as it pleases: Without the onus of accepting deposits or withdrawals they will fool around inside their black box to get an edge against their customers, anything to survive, right?

As an aside, -but more importantly- what MtGox is doing is a little puppet theater experiment for what's about to happen to the banking system worldwide in 2014-15.

As the hitchhiker's guide to the Universe says "Don't Panic".  :D  ...Have a towel handy.

bitcoin foundation is probably in on the scam

The people I know with balances in MtGox are in BTC, because they thought they were buying low when it dropped and consider BTC withdrawal the only viable option -- their international wires were taking over a month prior to this fiasco.  As much as they wish they held out and bought at $250, they can't, just as the vast majority of us can't just inject fiat into our MtGox accounts and buy at this price either.  If you bought BTC at $500 in MtGox, and you are informed of the news, events and issues, you are likely holding.  

But, in the scenario I described, you would have to have a % of BTC holders wanting to sell... which fits your description of uninformed people panicking.  So, in that regard, we're on the same page.  The only difference is that if BTC balances are 20x fiat balances in Bitstamp price terms, then liquidity on the buy side is just critically low.  With no way to infuse fiat from the outside, you can't raise it short of selling your BTC at a price that 90% of BTC holders probably realize is ridiculously low.  

If I could get fiat into MtGox today, I'd do it in a heartbeat and buy as much BTC at $250 as I could.  Unfortunately, I can't.  

If it never opens again, that price is meaningless.  Similarly, when you can't actually get it out, it's not even Bitcoins you're buying, but a nominal Gox balance.  If they ever again start reliably processing withdrawals, the price will soon come into line with the other exchanges, but that's seeming pretty iffy right now.

I think a number of people are gambling that Gox will, in fact, come back up again at some point, and are purchasing people's Gox balances at a deep discount.  I've seen such offers floating around on BCT and elsewhere.

This is assuming there isn't more direct and deliberate price manipulation by insiders or others.

My perspective as a MTGox-User.
I got a lot of money(USD) in MTGox, since I made some BTC and started trading with them on MtGox. I have withdrawn some BTC, nearly a year ago, which worked fine. I started my first EUR-withdraw about 4 weeks ago. MtGox claims that it takes 6 weeks for such a withdraw, so I have not seen that money, yet. So, that's my experience so far, with withdraws.

When MTGox stopped the withdraw of BTC and BTC-price went down, 2 options seemed really possible, regardless of what is really behind that decision of MtGox:
Either it is going down forever or it will recover.
There is no fast way for me to get my money out and if MtGox is going down I don't think, I would get my EUR after six weeks. So, the only option, that seemed plausible, was to buy BTC on at a low price and hope for the best.
So, today I put my last order into MtGox to buy me BTC with all the USD in there and am going to watch what happens.
I am pretty sure a lot of people think the same way.

I think that is the most reasonable thing to do. I am doing something similar.

But more people think just the opposite. If the majority thought like you, the bitcoin price would go up, not down.

Seems like a sensible decision, I'm in your boat and decided the same.

Buying bitcoins on Gox is risky, but could be quite profitable.

So who are these crazy people that are selling bitcoins on Gox?!

People who believe MtGox gave most of their bitcoins to the attackers and are now insolvent.  If that is true (and I am not saying it is) then they may believe holding dollar "debt" in an insolvent Japanese company is better than holding bitcoins as AFAIK there have been court cases in Japan regarding the standing of bitcoins in a situation like this.  If you believe MtGox is insolvent, being owed USD "may" be safer than being owed BTC.  If enough people believe that sell BTC to hold dollars then you would see the price distort as it has.

Simple Version:
The exchange rate on MtGox may no longer represent the value of a bitcoin, but instead reflect the relative value of a MTGox IOU for USD vs a MtGox IOUT for BTC.

Enough people have heard and believe that a fix is imminent to help stabilize the price.
If too long passes without said fix materializing then more and more people will believe it to be a scam and bail out

Karpeles will come up with another story... and refuse to show any proof for it.

"Those weren't bouncy balls we were sitting on: We are hatching blue messenger Pterodactyls and as soon as they spread their wings we'll send you your assets."

Afterwards we'll sit here and ponder endlessly on how probable or logical or doable the explanation is... Meanwhile, inside the black box of Mt.Gox, free frappuccino's for all.

After the pterodactyls fail to materialize, K. will say that the stress of withstanding so much negativity slowed down his staff's ability to distinguish 00.00 from O.0 and that he'll think of inviting the frozen dissenter outside his offices inside to show him how awesome his minecraft palace looks in his computer.
K. is buying time, nothing else. What he does with that time is for him to know and for us to find out.

Perhaps they have some Magic: the Gathering cards left over from their previous business to pay off their debts.

Bitstamp were back up in 3 days.

Only if EVERY other exchange is suspended. If some do and some don't, then those that do share mt gox issue.

Their own problems were their own fault, just like everyone else's problems were THEIR own fault.  The difference is that other more competent exchanges, like BitStamp, fixed their own problem in a timely fashion without drama and blaming everyone else, while Gox is still down.  The problem wasn't that they had buggy software, because that is always going to happen to some extent.

The problem was their destructive and dishonest response to their problem.