Bitcoin Forum

Peter R Rizun’s Theory on the Collapse of Mt. Gox


TL/DR: A young man had a secret.  To keep it hidden, he kept digging until the hole was a billion dollars deep.  This is a speculative tale of a great bitcoin theft from MtGox in 2011 and the efforts that this man undertook to fix it.  The tale explains the bitcoin bear market of 2011, the explosive rally of 2013, delayed fiat withdrawals, malled transactions, and a bot named Willy.


“By the time you realize that real life has begun, you are already three moves in.”—Author unknown


It was June 19, 2011.  Mark, a 26 year-old young man—a boy really—was ecstatic.  He had recently purchased MtGox—a small, online exchange for trading virtual tokens—and business was booming.   These virtual tokens were called bitcoins and Mark loved them.  

Bitcoins were an obscure curiosity: a peer-to-peer electronic cash system that allowed users to store and exchange credits with any other user in the world, nearly instantly, and without the assistance of a third-party or the permission of an authority.   All that was needed was a 78-digit secret number—a key if you will.

In order for his customers to withdraw their bitcoins over the internet, MtGox stored some of these keys on its online server.   The remaining keys were stored on USB drives and backed up on paper to prevent theft should the server be compromised.  

But theft was hardly a concern.  In October of 2010, bitcoins were trading for $0.10 and the half a million bitcoins held by MtGox was worth only $50,000.   But still Mark took precautions, diligently moving bitcoins to offline storage and leaving only what was necessary for customer withdrawals online.   He truly wanted both his business and bitcoin to succeed.  

By April, the bitcoin price had risen to $1 and by June it had exploded to $30.  Between June 1 and June 15, an additional one million bitcoins were sent to MtGox and immediately sold, crashing the price back to $10.  It was a hectic time, with hundreds of customers needing help, visits from the FBI related to the Silk Road black market, and stress related to the recent market crash.  Young Mark was becoming a victim of his own success: there simply wasn’t enough time to get everything done.  On this very day in June 2011, the keys to the recently-deposited 1,000,000 BTC were still sitting on his server.  

Later this day, a group of hackers gained access to MtGox servers and executed fake trades that the world could see, driving the nominal price of bitcoin near $0.  Mark was frantic.  He quickly regained control of the servers and learned the dark truth: the million bitcoins that had recently flooded in earlier that month were gone.  Mark admitted publically to the hack, rewound the false trades, but kept the truth of the missing coins a secret.  

How could this 26-year old explain to his customers that he had lost their bitcoins?  And if the world found out, would this kill the thing he loved so dearly?  Would he go to jail?  Or worse yet, would someone kill him?  Mark decided that he would do what he thought was right: he would slowly earn back the lost bitcoin with MtGox trading fee profits and eventually make his customers whole again.  He still had over 500,000 BTC left—he moved 424242.42424242 BTC between bitcoin addresses and convinced the community that MtGox was solvent.  As long as withdrawals didn’t exceed deposits over a long period of time, no one would ever find out the truth.  Or so he thought.

Meanwhile, the bitcoin thieves slowly mixed their coins with other coins, obfuscating the chain of ownership, and then re-selling these coins on MtGox using sock-puppet accounts.  Mark tried to stop them, but there was no way he could know for sure which accounts were fraudulent—he even accused innocent people of bitcoin laundering.  The constant selling of these stolen bitcoins drove the price down to $2 in November 2011.  Mark faithfully used all of the MtGox profits to purchase coins back during this decline.  But he would never use customer funds—that was a line he swore not to cross.  

The selling of these stolen bitcoins continued at a diminished rate over 2012, and Mark continually purchased coins using the MtGox trading fees.  The bitcoin economy was growing and new exchanges were opening up across the world.  His bitcoin reserves weren’t building fast enough but the price of bitcoin kept rising (along with the dollar value of the missing bitcoins).  He was worried that other exchanges would suck coins out of Gox and reveal his secret.  He decided he needed to take decisive action: for the first time, he used customer funds to purchase real bitcoins.  These large purchases by Mark further increased demand and ignited the great rally of spring 2013 when the bitcoin price shot from $20 to $266.  Mark had reduced his liability in bitcoins, but in dollar terms the coins that were still missing were worth more than ever before.  

On May 15, 2013 the US Department of Homeland Security seized millions of dollars from the MtGox Dwolla bank account. MtGox dollar reserves were already depleted at this point, and with the recent seizure, Mark could no longer make good on customer withdrawals in US dollars.  

Under the guise of “banking problems,” MtGox slowed US dollar withdrawals to a trickle in the summer of 2013.   Customers became increasingly worried and began to bid up the price of bitcoin on MtGox, as this was the only way to escape with their funds. MtGox had little fiat and very little bitcoins, but it learned one thing: as the price differential between Gox and BitStamp grew, the outwards flow of bitcoin slowed dramatically.  

And so Willy was born.  Willy was a bot, discovered by Wall Observers from bitcointalk.org and named by Opet on Bonavest's trading show, who would consistently purchased bitcoins at regular intervals between November 2013 and February 2014.  Evidence that Willy belonged to Mark was revealed when both web and API trading at Gox was disabled for a brief period of time, exposing Willy as the only one left buying.  

Willy served two purposes: he drove the price of bitcoin on the MtGox exchange high, thereby slowing and sometimes reversing the outward flow of real BTC, and he reduced the number of GoxBTC held by clients.  Of course, this meant that Willy eventually became the owner of a huge number of GoxBTC (that were of course no longer backed by real BTC).  

By December, the situation at MtGox was grim.  In a desperate attempt to attract more funds, Mark offered reduced trading fees under the guise of celebrating their 1,000,000th customer.  This partially worked, but Mark knew it was too late.  If MtGox collapsed, it must appear that he didn’t know about the theft until now—for it was better to appear incompetent than criminal.  

It was time to cover his tracks.

He purposely mixed immature coins into bitcoin withdrawals to delay the outward flow of coins, and later began malling his own transactions.  He added the Gox malleability weakness not as a bug, but as a feature, so that it would seem plausible that outsiders had recently stolen the coins without his awareness.   No coins were actually lost to malleability.  

The MtGox coin supply dwindled to 2,000 BTC and on February 7, 2014 he had no choice but to disable bitcoin withdrawals.   The end was near.  

The problem Mark faced was that his customers had $150,000,000 credited to their accounts, yet the MtGox bank account only contained $38,000,000.  He could blame the missing bitcoins on transaction malleability, but how could he explain where the fiat money went?

He shifted Willy into reverse and cranked the throttle.  Willy relentlessly dumped bitcoins into the open bids.  The price fell further and further, eventually dropping well below the BitStamp price.  But still not enough people were buying!  He needed his customers to buy the GoxBTC.  Willy kept dumping coins until finally the price dropped below $100.  MtGox even acquired new USD bank wires from customers looking to purchase the cheap coins.   By this time, the majority of Gox customers had converted their dollars into bitcoins.  

On February 28, 2014, Mt Gox filed for bankruptcy protection in Tokyo, reporting 6.5 billion yen in liabilities, 3.8 billion yen in assets, and 750,000 of customer bitcoins missing.  Willy had failed to completely close the fiat solvency gap and Mark finally admitted to having lost the coins.

Now we watch the rest of the story unfold.  A story of how an oversight during a hectic period, an untimely theft, and an attempt to cover it up, lead to the greatest loss in the history of bitcoin.  

Great article!

The only thing I don't agree with is how the coins were stolen in 2011. I think the hackers dumped Goxbtc and not real btc on the exchange to crash the price to zero. The theft would more likely have been some kind of inside job.

EDIT: sorry - this statement actually fits with what you are saying  ;D But I do think it is either Mark or someone close to him who has the coins.

Thanks,  great story.

The best thinking on the matter to date.

Please link to evidence of the existence of Willy and its persistent buying during API outage

You had to be there to see it. While there are loads of bots trading exchanges this Gox bot spent the first couple of months only buying at regular intervals of a few minutes (periods of an hour or so several times a day most days), and the last couple of weeks selling at the same rate or faster! By the end it was impossible not to notice.

Okay, but what about its persistence during API outage? Perhaps a link to a forum post?

Can I get the movie rights?

Has to be better than Suck My Geek.

There should be several posts in the Wall Observer thread that document this.  Unfortunately, there are thousands of pages to search through.  I didn't comment on it direcly, so I can't check my post history, and I don't remember the exact date when this happened.  Hopefully someone else remembers and we can reference the old posts.  

The other thing I'd like to reference is something about some "secret" that Mark had.  I remember vaguely something about an important secret, but I forget where I originally heard this.  

Nice read.

I thought this comment from Reddit was interesting:

• Gargoyle88 2 points 18 seconds ago

Oh, and you could roll the failed partnership with Coinlab in there. Maybe Karpeles didn't realize that he would have to:

"Mt. Gox has failed to deliver all passwords,Yubikeys, administrative logins and any other security information required so that CoinLab may assume operation of the Bitcoin exchange services for customers in the United States and Canada.."

Realizing that this would expose the whole mess, he chose to breach and risk the lawsuit that followed.

The best explanation so far

Super write-up! I've mostly avoided reading the various theories on what happened to Mt.Gox... but this one is really great! Self-consistent and plausible.

(Also, it's a theory that worries me much less than one where 700,000+ bitcoins were stolen very recently)

That's kind of funny actually. Coinlab has just had an endless string of disasters (Alydian mining? *facepalm*)... but now it actually looks like they dodged a bullet by not taking over Mt.Gox!

Hmm... it's a little crazy to think that Mt.Gox's fumblings may have played critical roles in Bitcoin rallies as well as, obviously, the spectacular crashes.

Peter, you should be a writer!

Thanks Chris and everyone else for the compliments.  I couldn't have put this story together without all the smart ideas and pieces of the puzzle I learned from the other contributors here.  


I should say again for everyone reading that this story is a mixture of fact and speculation.  It could turn out to be wrong, of course.  

I suppose this could be real, but if your willing to (A) hold only fractional reserves and (B) not allow withdraws of a certain currency for an indefinite period of time, it was still perfectly possible for Mark to get out of this.

If Willy had reversed before Bitcoin withdraws were dissabled, then it would have gotten ~$1000 per coin for some coins. Then, dissable withdraws with Willy going the whole way down, hell, Willy could have probably cleared the entire orderbook from $1000 to $100 in a day and nobody would have questioned it, given the "bad news" of Gox not enabling withdraws. Hell, nobody questioned it when it happened on Bitfinex/BTC-E. Thats a LOT OF MONEY and probably an average price per Bitcoin of about $700.

With such a huge selloff Willy could almost surely get back more coins back than it sold, without wasting any fiat. And if it couldn't, people couldnt' withdraw Bitcoins anyway. If they expected MTGox Bitcoins to have as good credit risk as Gox fiat, then just issue Bitcoins to yourself in your DB, send it to Bitcoin builder, and withdraw real Bitcoins, and sell those Bitcoins on stamp, and grow your USD reserves, while pushing down the BTC price on your exchange because you're filling it will fake BTC. Then buy the BTC up with the arbitrage'd dollars from stamp. If people DON'T expect MTGox Bitcoins to have as good credit risk as Gox fiat, then just buy the coins with willy after tanking your own market and causing a huge market. In either case, the end result is that you end up with MORE Bitcoins than you started with, without losing any fiat, and in fact gaining fiat in the form of tx fees while the whole panic is going on.

Then, calmly open withdraws back up, a couple of days later, and claim that nothing happened but a glitch in TX malleability, and then posts like the OP's wouldn't even exist. And when you open up withdraws, BUY BITCOINS LIKE NUTS going into the announcement. Result? Huge price increase, and you can sell your BTC back for MUCH more expensive, and now you're making fiat too. Repeat maybe one more time and you're solvent in both BTC and USD.

I think you're basically suggesting that Mt.Gox could have day-traded its way out of insolvency. Sure, that could always work in theory... but there's no guarantee the market wouldn't move against you (people could still arbitrage with other exchanges if withdrawals weren't disabled). Mark might have just dug an even deeper hole (in fact, I think this is how some traditional banks have failed to get out of insolvency...).

I wished I found a flaw in your plot, because it is devastating for anyone's hope of ever getting stuck assets out of Gox.
But so far I didn't find any. Congrats, that all sounds quite reasonable to me.

Looking at the volume charts between mid 2011 and today, Gox may have gained about 200k-300k btc in total from fees.
That lines up well with about 800K btc missing, operating cost can probably be neglected in that calculation.

Keeping the keys for 1000000 btc on the server would not have been necessary. Once there was a substantial amount of btc on hot wallet addresses, they could have sent them to cold storage with one click, even if this was a paper wallet being locked in a bank safe.

What's left, at least for me, is to check for any confirmation of a $1000k steal on that day. We are looking for $1000k coins which mostly entered Gox during the weeks before and then were all spent more or less at once. The thief would have had to do the latter in order to prevent Gox from spending them first using a backup of the wallet, after the theft had been detected.

I wonder how plausible it is that the fact of such an amount of coins being stolen could be kept secret. But never verifying your wallets against the blockchain would  certainly be helpful. In that context, the late detection of of double-spends due to TM is even plausible without introducing TM on purpose.

^^

Oh right, I didn't think of this. Couldn't most exchanges have deposits go straight to cold storage? *shrugs* Maybe Mt.Gox didn't run that way.

Thank you for the comments.  

I agree that this process could have and should have been automated, but I also think that it's plausible that it wasn't:

1.  Prior to the run-up from $1 - $30, I imagine that the amount of bitcoins on Gox was roughly constant.  Mark never bothered to write code to automate this process since it was rarely needed, and the security was really designed to protect $100,000.  Not $30,000,000.  He knew he should write code to do this as the price was climbing, but was just too busy from the explosion of business.  

2.  I assume that MtGox was flooded with bitcoins deposits in the days before the crash from $30 to $10.  So it would make sense that the hot wallet would be very full.  If indeed transfers to the cold wallet were not yet automated, then I think what I described is still plausible.  

Sorry for interrupting the party, but in case anyone is taking it seriously please remember from a technical perspective it's all BS.

Now please carry on.

What's the objection from a technical perspective? It all seemed plausible to me. (I'm genuinely curious)

Great write up, thank you.  So basically the theft happened long ago and malleability is just a smokescreen.  There were thieves, but long in the past.  Willy at least kind of explains the huge trading volumes on Gox during it's end of days which to me is an interesting side note of this mystery.

Thanks!

You raised one of the objections yourself in a previous reply.

There is never a need to put the key to a user's deposit address on an online computer, any wallet system which could remotely be considered 'cold', by definition, would not do that.

Also if there was such a jumbo tx, I am sure it would be very visible on the blockchain.

The million bitcoins sent to MtGox in early June would have been deposited to several unique addresses and over several days, as these coins came form several unique customers.  The thief would have stolen them with several transactions (over a shorter period of time), rather than merging them into a single 1,000,000 BTC TX.


The just-dice.com deposit addresses are "hot."  I think this is common in fact.  Just-dice uses recent deposits to pay out new withdrawal requests, thereby minimizing transfers to and from cold storage.  If you request a just-dice withdrawal, your coins will almost always come from someone else's deposit address.  [People have reported on the troll box that they've spontaneously received free coins.  This happens when someone erroneously sends just-dice.com coins to the address that sent them a withdrawal.]  Just-dice.com automatically transfers coins to cold-storage when the amount of hot coins crosses a certain threshold.  These coins are transferred manually back to the hot wallet when needed.  

My theory would have MtGox in its early years using a similar system, except automated transfers to the cold wallet were not yet implemented.  Yeah they should have been, but I believe it's plausible that they weren't given how quickly the price (and thus the risk of not doing so) increased.  

This would explain why Mark's attitude recently doesn't reflect that of someone who just lost all that money. It's more like a sense of resignation at a long-since bygone mistake that has been eating at him (and causing him to stress-eat) for years.

I remember a thread after the june/2011 hack from an user that bought ~200k coins at $0.01, and, theoretically, it saved mtgox from losing it all because he was able to buy before the thief had a chance to withdraw, and that drove the price back to $0.30, and the thief only got ~2600 coins. (Edit: because of the U$ 1000,00 daily limit at the time). That was the "oficial" story.


+1

This was terrific.

Cross-link to Reddit:  http://www.reddit.com/r/Bitcoin/comments/1zdnop/peter_rs_theory_on_the_collapse_of_mt_gox/ (http://www.reddit.com/r/Bitcoin/comments/1zdnop/peter_rs_theory_on_the_collapse_of_mt_gox/)

agreed with others, good write up and sounds quite plausible. once things unfold a bit more, you should publish a book, "Empty Gox"

Meanwhile I checked for confirmation of a $1000k steal the 15th of June 2011, but found none.
The estimated transaction volume on that and the following days is about 230k for the entire bitcoin system.
See here (https://blockchain.info/charts/estimated-transaction-volume?showDataPoints=false&timespan=all&show_header=true&daysAverageString=7&scale=0&format=csv&address=).
It is not plausible to me that a thief would risk a reversal of his theft, when all he needs to do is to spend the coins to a new address.

The saying is that about 2000 btc were stolen that day, conjectures about many more stolen coins, e.g. 500k, seem to be widely rejected.
Since the 1000k theft is key to your plot, I wonder if you have a particular source. Anyway, I now like your plot even better, guess why  ;)

I wasn't paying attention to Willy, but 2011 was exciting. Thank you for the write-up.

Thanks for looking into this.  The link you posted reports the estimated transaction volume, where Blockchain.info has attempted to subtract off the change.  We must consider the total output value as the "change" could have gone to the thief too.  The total output volume on June 19, 2011 was 1,301,575 BTC (EDIT: and 5,000,000 BTC on the 20th and I don't know the time zones assumed.)

https://blockchain.info/charts/output-volume?showDataPoints=false&timespan=all&show_header=true&daysAverageString=1&scale=0&format=csv&address= (https://blockchain.info/charts/output-volume?showDataPoints=false&timespan=all&show_header=true&daysAverageString=1&scale=0&format=csv&address=)

Furthermore, although unlikely, it may be possible that the robbery didn't happen all at once, but over a few days.  When the thieves hit their target, then they set off the alarm bells by faking the huge sale that took out all the bids.  


Why?  I'm curious.

Thread in question:

I'm Kevin, here's my side.
https://bitcointalk.org/index.php?topic=20207.msg252680#msg252680

Regarding the discovery of Willy, it wasn't "Wall Observers," whoever that is...

I discovered and named him. My original thread here:
http://www.reddit.com/r/BitcoinMarkets/comments/1uhjrb/intriguing_bot_activity_on_gox_for_the_last_2

Not a big deal, but kinda rude to take away what might be my only contribution to the upcoming Mount Gox movie... :)

PS: not a bad theory.

It was even 9235k the 16th. I considered the total output volume too, but it made no sense to me that the thief would need any change, because he has no reason for not spending the entire inputs, except to obscure what he's doing.
OTOH, the volatility of the total output volume was so high those days, that I find it impossible to see an indication for a $1000k move.


Now I have a reason to get more popcorn and hope for a happier ending.

I apologize if I didn't give credit where credit was due.  I actually don't know who first noticed Willy nor do I know who named him.  The only place I've read about him is in the Wall Observer thread, so yes I was too quick in assuming that fellow Wall Observers were the first to notice him.

But your Reddit posts says its from "about a month ago."  Weren't we talking about Willy in December on the Wall Observer thread?  Does anyone remember when exactly the web and API interface went down and we watched Willy execute trades all alone?  Wasn't that November or December?  Were we calling him "Willy" at that point?

The discovery of the bot actually happened in December, yes.  I had briefly described it during a live broadcast as a guest on Bonavest's trading show.  It was also during a later broadcast that I took suggestions for a name.  One of the other guests listed "Willy" as an option, so I later chose that one as the best of the bunch.  From that point on, the name stuck. (It's kinda cool that it spread to everyone, LOL)

Check out the reddit thread I linked and you'll also see that I'm the one who captured and shared the screenshots the night the trading API went down.  That was when I decided that it was highly likely that Willy was owned and operated by Gox itself.  (A fact that I also shared on another live Bonavest trading show, as well as other places like tradingview.com)

Interestingly enough, I confronted neotufur (sp?) in the #mtgox channel on IRC about the bot a few weeks later, and he (or she?) adamantly denied the fact that the bot belonged to Gox.  His explanation for how the bot could trade when nobody else could was something to the effect of: "if you have enough money, you can buy a direct privileged connection to our servers, so that's probably how the bot kept going when nobody else can trade."  He then called me crazy for believing it belonged to Gox and almost banned me from the channel!  (I'll try to dig up the IRC log for ya... it was amusing as hell!)

Whatever the case, I meant it when I said that it's no big deal.  I really do like how you summarized the role that Willy might have had in this mess, and it's definitely plausible!

Edit:  Here's some of my screenshots from when the trading API went down on January 7, 2013, but Willy was still making trades for the next 90 minutes while it was down for everyone else: http://imgur.com/Ub46sWE
and another: http://imgur.com/wyW1g4p

On another note, here's a thread I created on 25 January warning of the impending doom at MtGox: https://bitcointalk.org/index.php?topic=431117.0

Opet, I sent you a PM to clarify and will edit my article to give you priority for "Willy" once we clear up the dates. 

Mark was in #bitcoin-dev at the time of the heist asking the bitcoin devs to roll back the blockchain, so that lines up with this theory.

Very interesting.  You wouldn't happen to have an IRC log or a link handy to a thread discussing this, would you?

this has been an awesome thread, thank you

Replied.  Not really a big deal, though, so don't worry too much about changing anything.  Just the fact that the name "Willy" stuck and spread through the community was enough to make my night! :)

If this theory is correct, there must be some significant transactions around that 2011 hack. Could you identify it on the blockchain?

This explanation is simple plausible and practical. really great.

I like to say, never attribute to malice that which can be explained by stupidity. This is one case.

There's no smoking gun, but there's enough output volume to conceal ~1,000,000 BTC.  Here's a graph of bitcoin transfers for June 2011 constructed from data I just pulled from blockchain.info.  Note that I'm not sure re time zones, so look at the 18, 19, and 20th when thinking about what happened at the time of the hack.  Also note this is a log scale so that both curves are readable.  

https://i.imgur.com/JK4Nucv.png

Remember that total output volume is 100% accurate, but blockchain.info's estimated transaction volume depends on an algorithm that attempts to identify change and may thus be unreliable.  

If I were the thief, I would try to transfer the money out very quickly, as I'd like to finish it before Mark discovered. Therefore, there must be a few very big transactions if you were correct.

Great article, now it's so clear and I begin to get everything what's happnening . Makes me think more about an effect on the price of btc

I am just going to add on to the speculation a bit here. There has been a confirmed leak of audio from January with Mark and a bank of theirs in Japan. This bank was going to shut them down. Without a bank mt gox would have to stop operations and there would be withdrawals in mass. The shit would hit the fan if they were operating under fractional reserve. Is it just a coincidence then that shortly after mark finds out his bank is shutting him down that they lose several hundred thousand bitcoins due to "malleability" ?  I don't think so. Mark is using the malleability as a scapegoat. I think he was operating under fractional reserve and I also think he tucked away many bitcoins for himself since his exchange was going down anyway.

Chapeau, Peter!

If Willy buy bitcoin why mtgox only 2,000 BTC on feb?

Several...over a shorter period of time...we may as well say over a year. If you put no limit on Mark's incompetence, then sure, anything is possible.


Again, if you deposit addresses are hot, there is no way it can be called cold wallet. Also, an exchange is different from a betting site, which does BTC withdrawals much more often(you don't trade and want to collect what you win ASAP, and you certainly don't deposit to gamble in tens of thousands of BTCs!), it would be beyond ridiculous if Gox's deposit addresses are hot.

Very interesting.

Still, I'm waiting to hear it from the big horses mouth. Now that administrators and lawyers are all over the company, it will be hard to hide all the internal communications, account movements and trades over such a long period.

Unfortunately, I've seen the remaining assets of a company in this state squandered by all the fees vultures that get involved during bankruptcy. They will be picking away at the Gox assets for a while. I'm owed quite a lot of money from a company that went into administration three years ago, the administrators say that they are still sorting it all out - which is double talk code for, there is still money in the bank and assets to rape so they can extract out more fees.

I just went over some chatlogs at http://bitcoinstats.com/irc/bitcoin-dev/logs/2011/06/19 (http://bitcoinstats.com/irc/bitcoin-dev/logs/2011/06/19) and it turns out I must've remembered wrong. Still an interesting conversation to go over if you read what MagicalTux (Mark Karpeles) says or rather what he does not say..

In the chat log I find this: https://blockchain.info/tx/84f96975ea88d317676771a482c71f39ff53beda790c89c07ae82e427b4d090f

But if that was a theft, there was no reason to leave a 32.11BTC change

This may look like Mark bought Mt.Gox from Jed McCaleb in 2010, but the ownership did not change until March 6th, 2011:
https://bitcointalk.org/index.php?topic=4187.0

These complicated explanations do not make sense.

If you own the exchange (or indeed if you 0wn it) you can publish whatever you want in the orderbook if you want. No need to execute the actual trades.

If you want to steal btc or fiat you just transfer it out. Why trade with yourself first?

you trade with other accounts in your exchange to change the amount of btc or fiat you owe account holders... in the case of driving btc to 1/5 of price in other exchanges you can then buy the btc already lost stolen at discount

http://pastebin.com/W8B3CGiN

Interesting theory... watching this for sure.

If Mark is as competent as your theory says, how do you explain the piss poor customer support and PR at MtGox?

Watching, thanks.

M

1,000,000 customers and a hand full of staff maybe?

Which means massive incompetence in management, hiring, etc.

No this isn't true.

When you close off withdraws for BTC, you can dump BTC to your own exchange. Now either people re-bid price up to where it was before, in which case you calmly continue dumping, or they let the price fall, in which case you put up a bid. Since there's no cost to issuing as much BTC as you like, eventually the price will have to fall to 0 (or close to it). Then you can calmly re-buy everything your short.

Thanks Peter for sharing your thoughts ::) ??? :oπ,

Theory makes perfect sense, and explains market anomalies. Still the one question remains: Who did take/steal the original 1,000,000 bitcoins?

It's not even really about re-buying at some point. You dump fake btc, so demand rises and people will put their fiat into BTC. As the fiat doesn't get paid to real accounts, but to yourself, the total liabilities in fiat on bankruptcy decrease and the BTC you claim as hacked and gone.

This makes sense in a very scary way. 

This theory also explains the terrible customer support and PR.

1) If Mark was deep in the hole, then ever single cent that they made from trading fees would have gone into fixing the hole.  Any money spent on customer support and PR would have been less money to spend on fixing the hole.

2) Any competent PR or customer support person would have quickly figured out what was going on, and resigned and spilled the beans.  Having a big secret made it impossible to hire anyone competent.  Even a PR or customer support person with no ethics or moral character would refused to have worked for MtGox, because the big secret meant that they were unlikely to get paid.

Because it is non-trivial to generate a computer system that creates realistic looking trades in an order book.  If you generate fake trades, then pretty soon it will be obvious to everyone that something is very wrong.  Generating realistic trade data is something that requires a small team of programmers, who you can't afford because you are in the hole.

Madoff had programmers that did nothing except work on algorithms to generate fake trades.  MtGox didn't have the money to do this.


Because you are not trying to steal BTC or fiat.  You are trying to cover up a theft that was done by someone else.

I don't know about the details of the initial loss of bitcoin, but if you replace the first paragraph with "X loses a lot of bitcoin" then the rest of the story makes sense.

He might be competent in many things, but no one is competent at everything.

This is why companies exist.

http://blockexplorer.com/tx/84f96975ea88d317676771a482c71f39ff53beda790c89c07ae82e427b4d090f

Mark said he made this 432k transaction to move those coins to a safer place. That means to me that he moved it from the hot wallet to the cold wallet. This is more evidence for Peter R's theory that the hot wallet had a Lot of coins.

http://bitcoinstats.com/irc/bitcoin-dev/logs/2011/06/19

Great Article. Just another reason bitch coin is a fail. how many times can this happen, with these 'actors' playing Brady Bunch trust me with your money attitude, then bite you like the snakes they really are???!!! And with NSA having back door entry to all windows devices how is any of it safe?? (if your a btc miner and have a life style where you can trade all your btc in person your most secure). Why would you wanna use something designed by the NSA and published under the acronym Satoshi, if it was honest shouldn't they tell you who made it?? Why lie?? Right bc we wouldn't use it. ( Don't know why coming from Japan is Better???!!!) You guys will be on Celebrity Green Room Platform eventually, still have $500,000 for anybody that can hack my site :)

um. 
Exchanges <> bitcoin.
-1

Exchange management <> bitcoin.
-1

completely off the wall comments, do you by chance live under a bridge?  (ie a troll)
-1

M

• Which transactions show the 1M BTC transfer from and away from MTGox? So many BTC must be tracable... ok.  reading up on the total output...    
• Didn't MTGox have a withdraw limit already at that time?  Or was that withdrawlimit coupled to the BTC price on mtgox? It seems that withdraw limit was coupled to the BTC price and had a huge bug anyway.... Didn't use MTGox a cold wallet at that time for 1M BTC?
• Did people really see Willy sell BTC in February?   Here is from earlier: http://www.reddit.com/r/BitcoinMarkets/comments/1uhjrb/intriguing_bot_activity_on_gox_for_the_last_2
• readin up here and I am shocked: https://bitcointalk.org/index.php?topic=20207.msg252680#msg252680 (https://bitcointalk.org/index.php?topic=20207.msg252680#msg252680)

Yes I'd like to see that too...

manifold  

PS: yes I also was goxxed... :-(
PPS: Interesting story, that at least explains all the events... but I hope it's not too close to the truth.
PPPS: The most puzzeling thing for me was the missing Fiat...  and your story (A bot selling/buying fake BTC) explains this....

nEVER understood the irony of pointing out trolls (maybe one of you trolls can explain it to me, by inbox of course), anybody that can comprehend the definitions of words and knows how to use them, feel free to reply to my post, constructive comments about post are always accepted, everything else is cowardly. Im in LA, never scared of niggers anywhere :)

excuse me?

I just ignored someone with an activity of 5.  That's a new record for the bright Idea.

This has to be the best explanation I've seen. Excellent article well done Peter R.

If this is true, then a huge majority of bitcoin's price is not 'natural' or sustainable growth (no more ?Willy?). This seems like incredibly bearish news if true. Anyone else wanna think this through with me?

It always seemed like the growth was just to much and unnatural. It always felt like there was so much buying pressure.  If there really was a Willy it would be really bad news now.  Now there isn't as much buying pressure.

Quite the interesting read Peter R.  Nice summary of events with a sprinkle of what-if that seems quite plausible.  My hats off to you good sir.

So how does one find the fckers that stole the coins, or is that impossible?

                                                                                     
                                                                                                ^^^^
                                                                                          Ban this racist asshole!

 You just showed your true colors.

Most interesting theory of Gox to date.

This is the most interesting part of this theory imo, if the price has been manipulated to this degree until last week then what are bitcoins really worth? Looking at the charts there is a definite change in patterns since the Gox related crash on 25th Feb. This could be explained by the removal of a good portion of traders via Gox, but the volume (outside of whale moves) is remarkably low. Is there nearly as much interest as we thought?

It's not racist if he's a n...african american.

On the other hand, the loss of all of the fake GoxBTC is a deflationary event. People are no longer spending their money to buy the fake coins, they are going to buy the real ones, which may drive the price further up.

This makes more sense than any other theory or explanation I've heard.

Still offensive though.

hy,
nice writing!
could you explain what "immature coins" means?

When a miner finds a new block, he is permitted to issue what's known as a "coinbase" transaction to an address under his control.  The value of this coinbase transaction must be equal to or less than the block reward plus the sum of all transaction fees included in the block.  

The problem is that these new coins could disappear should his block get orphaned or a major blockchain re-org event were to take place.  For this reason, these new coins are considered immature and un-spendable until they are buried 100 blocks deep in the blockchain.  If you try to spend a coinbase output before it has "matured," it will be rejected by the network.  

Why might MtGox have had immature coins to begin with if such coins can't be transferred?  The answer is that some miners were mining directly to their MtGox deposit addresses.  

Nice proposal.  I hope that it can be confirmed and improved as more data and analyses become available.

I have two questions:

(1) The proposed loss of 1 M BTC at that time could have been theft by hackers, or could have been any of the other hypotheses that were suggested (theft by insider, Mark selling the coins off-market,  police seizure, lost keys, etc.).  Are there evidence or testimonials that point to hacker theft, specifically?

(2) What do you make of this theory, that MtGOX sold/used 750 kBTC to settle the 75 M$ CoinLab lawsuit? http://www.reddit.com/r/Bitcoin/comments/1z8vaq/crowd_detectives_reveal_mt_gox_bitcoin_heist_as/ (http://www.reddit.com/r/Bitcoin/comments/1z8vaq/crowd_detectives_reveal_mt_gox_bitcoin_heist_as/)

The only things I personally know for sure is that MtGox was indeed hacked or "hacked" on June 19, 2011, but that Mark denied heavy losses and then moved 424242 BTC to prove or "prove" solvency.  One reason I like the theory is that it also explain why the bear market of 2011 was so severe: the hacker was selling about a million coins into an illiquid market.  

I've heard rumours that Mark was on IRC asking the developers, in a panic, to help "reverse the blockchain," but no one has been able to give me actual evidence of this.  I also have heard whisperings of some "secret" that Mark had, but again I have no real information.  This thread from June 20, 2011 is really interesting [https://bitcointalk.org/index.php?topic=20207.0 (https://bitcointalk.org/index.php?topic=20207.0)].  Kevin bought 260,000 BTC for under $3000 during the crash and thinks he could have snuck them out of Gox if he were more prepared.  This trade was apparently rewound.  

Hopefully we will learn the truth in time.  


I don't buy this theory.  If it were true I think we'd have strong evidence that CoinLab actually received $75 million.  And if those coins were sold in May 2013, I expect we'd have seen a much sharper decline in the bitcoin price.  EDIT: and most importantly, if this were the case, Mark would have undeniably been illegally operating an insolvent business--even CoinLab would have known this.  Word would have gotten out sooner.

Apparently the lawsuit is still in progress and is scheduled to be tried in Nov/2014, may drag on to 2018:

https://bitcointalk.org/index.php?topic=477142.msg5261573#msg5261573 (https://bitcointalk.org/index.php?topic=477142.msg5261573#msg5261573)

Reply by MtGOX to the lawsuit:
http://numismatics.pwnz.org/coinlab-v-mtgox-answer-complaint/ (http://numismatics.pwnz.org/coinlab-v-mtgox-answer-complaint/)

Reply by CoinLab to MtGOX's reply:
http://thegenesisblock.com/coinlab-files-response-mt-gox-lawsuit/ (http://thegenesisblock.com/coinlab-files-response-mt-gox-lawsuit/)

Lawsuits are often settled out of court, but if that had happened I suppose that we would have known.

However, if MtGOX had settled the lawsuit by handing over 750,000 BTC instead of 75 M$, CoinLab obviously would not denounce him.

Deleted. Wrong thread. Sorry.

Dig around a bit you will see CoinLabs more over Peter Vessenes is no incubator or entrepreneur, the trail of scams and losses, and incompetence following him around is shocking. He screwed over Gox, no question in my mind. Even The Bitcoin Foundation is a way to give legitimacy to his impetus.

Interesting theory, but it doesn't jive with all the facts. The rallies correlate very well with Google search activity. If one man or bot was driving these rallies then you would not see the search activity behave in Google the way it has during the rallies. Also without the support of the bot, the market would have severely crashed and stayed down after Mt Gox closed. I really enjoyed the intrigue in the theory (not that Bitcoin doesn't already have enough intrigue) and think it would make an excellent movie.

Another reason to doubt the theory is simply to read all the analysis blogs that follow Bitcoins price. Bitcoin market activity tends to follow the rules and trends that a stock/commodity does in general. Moving averages, levels of support based on Standard Deviation, etc. Other than the crash on Mt Gox in 2011, Bitcoin trading seems to follow these statistical rules. The statistical rules that govern market trading behaviour would be violated if one person were manipulating the market to that extent.

Last but not lease other exchanges have also been hacked and BTC have been stolen because of this transaction malleability problem. If this were engineered by Mark K, then other exchanges would not be affected. The theory also assumes that Mark K has the intelligence to pre-plan this all.  ;D

Good points.

Why should the bot / THK not simply belong to the part of Gox that binds the exchange to their merchant tools? This would be a simple explanation.

I can't believe Karpeles would leave everybody in the dark for so long, effectively taking any option of finding the hacker via the blockchain from the customers.

http://www.bitcoinx.com/report-mt-gox-claims-found-200k-lost-bitcoin/

The Reddit version (http://www.reddit.com/r/Bitcoin/comments/1zdnop/peter_rs_theory_on_the_collapse_of_mt_gox/) of this thread is cited in the Willy Report (http://willyreport.wordpress.com) so I thought I'd bump it.  Looks like we have more evidence that Willy was real.  

http://insidebitcoins.com/news/while-mt-gox-was-burning-karpeles-was-heading-home-for-the-weekend/29106

IMO, Mark is a patsy and when he dies of a "heart attack" we will never really know which spooky agency got away with a huge number of BTC.

I actually think there is also a possibly that those stolen coins were sold and the fiat profit were used to bid up the price and that the process was rinse and repeat until the energy was all used up.

In essence we have all benefited from that loss, and now we are paying the price.

That might be Mark's little secret.

Put a stamp on it  :D

I just read the theory on the collapse. Seems an interesting one. Just has me wondering, why something like this came out after almost 2 years after the hack .
And looking at the blockchain, wouldn't it be possible to trace the coins ?

maybe, but are you doing the work?

A new WizSec article - http://blog.wizsec.jp/2015/04/the-missing-mtgox-bitcoins.html

Intresting read, but doesn't really tell us much more... It would help if they could find that data gap.

At least know we are starting to get the full picture: a mix of lack of security, fear, and not really knowing what to do with so many Bitcoins on one's control.

http://weis2017.econinfosec.org/wp-content/uploads/sites/3/2017/05/WEIS_2017_paper_21.pdf

Here's an article, titled "Price Manipulation in the Bitcoin Ecosystem" that is inspired by this post and others like it.

It digs into the nitty gritty of willy.

such necro

indeed, but topical as well with the recent release of chat logs between Mark and (former Ripple) Jed McCaleb in court discovery

https://courts.ms.gov/newsite2/appellatecourts/docket/sendPDF.php?f=dc00001_live.SCT.17.M.1681.102741.5.pdf&c=87490&a=N&s=2

what???  ???

https://courts.ms.gov/newsite2/index.php?cn=87490#dispArea

read 'em and weep