MTGOX makes doublespend transactions for btc withdrawal request

[zeroday]

Two days ago I was asked by my technically inexperienced friend to investigate lost Mtgox transaction which has never appeared in blockchain.

I found his transaction on https://data.mtgox.com/api/0/bitcoin_tx.php, then converted it from base64 into HEX and tried to broadcast it myself.
However, after attempting doing so, I was really confused to find that the transaction is double-spend.

A day later bitcoins were finally delivered to the target address but they were sent with different transaction.

Did anybody experience the same behavior of Mtgox transactions?

[1714850004]

1714850004

[1714850004]

1714850004

[1714850004]

1714850004

[1714850004]

1714850004

[1714850004]

1714850004

[hannesnaude]

The same thing just happened to me. Here is the transaction from https://data.mtgox.com/api/0/bitcoin_tx.php

{"hash":"0f5295851dc64a16c0821bbc7519481b440fc7ed03079202e38e969bfb7bf42b","tx":"AQAAAANmVCUkhy2mi\/Rv4DTVDJsoMmorgnxT\/+dcyCfeA2PZHAAAAACMSTBGAiEAtLbnxaYH0kGIfvwTkt05eFV9T8UrzXtL2bQujJpd56gCIQDp1GQfDvugA8YVhWlW8UNqmRPhCKdNoVQWmlmPvFzK7gFBBNMOryM9FyMOGMAMJ6uv5JrOClPa5HMNUCG6gzEEhbrU7EYnnsnRb8eXZtFuqylcl4XXYG0MhcrFq4LBDVDoIQb\/\/\/\/\/KOY+ZghefBlRmoRdzDC\/vrVI0qKARmazozmt51eYntcAAAAAi0gwRQIgdC77lsJhoDboKHl5BOz72T+DjwJr1xwPa7alkqAyhf8CIQDryqYgX0K+qdiGhYjUJG3EqHxjs1Jt\/v9vIayBGLw6MwFBBC67mmF9A\/XJ1mFSlArtaN9Rq6jqexTqJ4+EFDJzE08oJQoGk0dh7SoAGbyej3pDajzMH7OTEMKFr\/hH8goVsHL\/\/\/\/\/U6kgUAQQKPewxaGoOpo1shMaupp1kJo0irR2HAROaRMBAAAAi0gwRQIhAK5brQwvvyo8ACZAhJm2zeICLwM8hZeSYzlU\/T9nAvO4AiBQHbm5FAJkCfj3612rLv02218+nzN6eU2rLMMCA0eEGQFBBBhNvejeGeF7QksMYwVB27RCCwbt4Uy9qhgrY6bpwfdjTV0vP5hM4CBNHkoeFs+6hcU1ugUdsm0b\/PQx0J+ug+r\/\/\/\/\/AlRfPlYAAAAAGXapFGqd08T1TKlDr+qvS6T7m+lSL64AiKwAhNcXAAAAABl2qRQkdKpKJbVNJrD\/uHvEbUu8G+dHhoisAAAAAA=="},

I tried to rebroadcast, but the tx gets rejected. Decoding this shows that this is because the second input has just been double spent in this transaction.
https://blockchain.info/tx-index/94395264

I find this extremely disturbing.

This was one of three payments sent this morning. I have yet to decode the oother two, but I expect to see more of the same.

[oxfeeefeee]

Now I know why my withdrawal transaction went missing.

I told them to hire some professional programmers on the support page, looks like I was right.

[zeroday]

May be gox does it intentionally because they are really short of btc and now they are broadcasting multiple double transactions from single address and are prowiding customers with invalid tx hashes during withdrawal ?

[bitcoinBull]

Similar problem here. Different error though "Unable To find all tx inputs". 3 of the 4 tx inputs are good, one is not.

[Nemesis]

Please explain how you converted the transaction ID to HEX and then broadcasted it yourself.

Can you do that with the BitcoinQT client?

[zeroday]

Go to https://data.mtgox.com/api/0/bitcoin_tx.php and find your transaction record searching for your transaction ID (hash) which you see as green text string when Gox confirmed your withdrawal.

It looks like: {"hash":"transaction_id","tx":"base64_transaction_value"}

copy base64_transaction_value to clipboard and then convert it to HEX string on this website http://tomeko.net/online_tools/base64.php

Then copy HEX string value and submit it on https://blockchain.info/pushtx


If you then see a text saying "An outpoint is already spent", this means you are Goxed and your transaction is invalid because it's a double-spend.
If so, just post it here to blame the Gox once again

[hannesnaude]

This was one of three payments sent this morning. I have yet to decode the oother two, but I expect to see more of the same.

Update. I sent three payments. One for 1BTC, one for 4BTC and one for 95BTC. The 4BTC payment was double-spent as shown in my earlier post. The 1 BTC payment eventually arrived. The 95 BTC payment did not show up on the API for a long time, and when it did eventually show up, I could see that it has also been double-spent. I include the tx here as documentary proof:

{"hash":"42c12ac94b36ef9df1df3bc455d1a12ace6ac77ce7b0911801bd825ed836e537","tx":"AQAAAAOl92w\/T63aKcsRLjgEpfsSPGsypEfE7pCR\/Jgs5y7AwQAAAACKRzBEAiAO3uf8IuVr+zluPCKdRAIoT5j0dcLN8\/CbKpP54Y67NwIgDNNSsqDEDO15y7P+8UcnuH6tify2aXpW\/J66\/aExSXQBQQTHApEazAnqZTt3DcvjZsr9xKTukyrjxsfeRf8\/nAfiFOImCJx65BRoFIOZ0n4RKA\/tP3NEzEiy0hX0LZLGvgg9\/\/\/\/\/x8cv3DnPFWn9UQgspw74cX17esph85C5uWLeTti0+kGIQAAAIxJMEYCIQCIQhu0lAQR5YBgUwCU6r9G9cavzsisrNhUf\/OxEJlApQIhAJGV1i3AsjLmm5sTmEAfDjYuBdtZkH0O9b5W0KS1bz37AUEElnAOqWR1F9XiCMdpOtcXNwB0tVC3j+pb7WcPICj+CuQY5Xq9qGa1mjsux7dLeySMaY2rdwr\/KtnyoN0x7QDnNf\/\/\/\/+bcWva335E4wPLOTj1ztmR\/ZLHuJ2qV4yZBT9lpwqu3AEAAACLSDBFAiBej2bGVd\/RGYQJWe5PWnJRT68KT4F86vwy89SHfomVswIhAMdn3LmmaxmThCxHPa9pW1Ek6mUL6ImJAv6glCMP20DvAUEEAb45uFY3vNyH+8JevKW7RoyXh7VfwvkUh0h2rcted72MqUWxF6R6hFUg0aDrAJeZ3+4Rac30H8kNjMUE\/JWhU\/\/\/\/\/8CAH8+NgIAAAAZdqkUJHSqSiW1TSaw\/7h7xG1LvBvnR4aIrPSGuhcAAAAAGXapFLbkxuKFfe2F5EmnegZ2rpThxZqjiKwAAAAA"}

Anyone who wishes to can see this tx for themselves on the gox API and also verify that it has been double spent, by submitting it at https://blockchain.info/pushtx . To see the details of the tx one can submit it at https://coinb.in/decode-raw-transaction.html. Both of these pages expect the tx in hex format though, so here is the tx as a hex string :

0100000003a5f76c3f4fadda29cb112e3804a5fb123c6b32a447c4ee9091fc982ce72ec0c100000 0008a47304402200edee7fc22e56bfb396e3c229d4402284f98f475c2cdf3f09b2a93f9e18ebb37 02200cd352b2a0c40ced79cbb3fef14727b87ead89fcb6697a56fc9ebafda1314974014104c7029 11acc09ea653b770dcbe366cafdc4a4ee932ae3c6c7de45ff3f9c07e214e226089c7ae414681483 99d27e11280fed3f7344cc48b2d215f42d92c6be083dffffffff1f1cbf70e73c55a7f54420b29c3 be1c5f5edeb2987ce42e6e58b793b62d3e906210000008c49304602210088421bb4940411e58060 530094eabf46f5c6afcec8acacd8547ff3b1109940a50221009195d62dc0b232e69b9b1398401f0 e362e05db59907d0ef5be56d0a4b56f3dfb01410496700ea9647517d5e208c7693ad717370074b5 50b78fea5bed670f2028fe0ae418e57abda866b59a3b2ec7b74b7b248c698dab770aff2ad9f2a0d d31ed00e735ffffffff9b716bdadf7e44e303cb3938f5ced991fd92c7b89daa578c99053f65a70a aedc010000008b48304502205e8f66c655dfd119840959ee4f5a72514faf0a4f817ceafc32f3d48 77e8995b3022100c767dcb9a66b1993842c473daf695b5124ea650be8898902fea094230fdb40ef 01410401be39b85637bcdc87fbc25ebca5bb468c9787b55fc2f914874876adcb5e77bd8ca945b11 7a47a845520d1a0eb009799dfee1169cdf41fc90d8cc504fc95a153ffffffff02007f3e36020000 001976a9142474aa4a25b54d26b0ffb87bc46d4bbc1be7478688acf486ba17000000001976a914b 6e4c6e2857ded85e449a77a0676ae94e1c59aa388ac00000000

[joesmoe2012]

Made a withdraw from gox a couple of hours ago, went through no issue (for BTC that is...been waiting on fiat for ages).

[bitcoinBull]

My withdrawal was finally processed (I had filed a ticket also), with a totally different transaction.

[hannesnaude]

My withdrawal was finally processed (I had filed a ticket also), with a totally different transaction.

Same here. Had a few more withdrawal go through without problems. I am glad that I am no longer dealing with gox. There's a long list of mysterious events at that site that they really should explain. These double spends not the least of them.

[Bloodislav]

Hola. I'm waiting for my BTC now 30 hours. No sign of any progress yet. Is there any way I can see my transaction hash if I didn't make note of it when I was doing the withdrawal? I have only reference from them in email, but thats it.

Thanks for any help 

[Hic et nunc]

I am waiting for my Btc for more than 4 days.  I just received this email:  


Dear  M

There has been a withdrawal from your Mt.Gox account:

Transaction reference: 4cc0c2b8-045f-4018-9b54-73c62a81b3ed
Date: 2013-11-03 18:20:20 GMT
IP: 2.747.283.435

The Btc have disappeared from my account and they are not in the destination address. Where is my money?
Here is a screenshot of the Account history:


But 700Btc not appear in blockchain:   https://blockchain.info/address/1PPWBeauKVg3PahkbA3VXXS6zrfvfsMNJC

Are they stealing my money?  I ask someone for help.

[zeroday]

what was the transaction confirmation number?
it's a long green string of digits and letters which is shown after you confirmed withdrawal.

[dave111223]

But 700Btc not appear in blockchain:   https://blockchain.info/address/1PPWBeauKVg3PahkbA3VXXS6zrfvfsMNJC

You kept 700BTC on mtgox...are you insane?

[fritzthecat]

At least he made many people with smaller figures very happy when they withdrew.
Or at least Mark who is enjoying Mojitos while his company burns down.

[Hic et nunc]

But 700Btc not appear in blockchain:   https://blockchain.info/address/1PPWBeauKVg3PahkbA3VXXS6zrfvfsMNJC

You kept 700BTC on mtgox...are you insane?

I think so.

[Hic et nunc]

what was the transaction confirmation number?
it's a long green string of digits and letters which is shown after you confirmed withdrawal.

Where can I find it?

This is the email I received: 

<<Dear X

There has been a withdrawal from your Mt.Gox account:

Transaction reference: 4cc0c2b8-045f-4018-9b54-73c62a81b3ed
Date: 2013-11-03 18:20:20 GMT
IP: 2.487.103.246

You can access your account history for more details.

Please contact us as soon as possible by replying to this email if you did not request this withdrawal.

Thanks,
The Mt.Gox Team>>

[Hic et nunc]

I am waiting for my Btc for more than 4 days.  I just received this email:  


Dear  M

There has been a withdrawal from your Mt.Gox account:

Transaction reference: 4cc0c2b8-045f-4018-9b54-73c62a81b3ed
Date: 2013-11-03 18:20:20 GMT
IP: 2.747.283.435

The Btc have disappeared from my account and they are not in the destination address. Where is my money?
Here is a screenshot of the Account history:


But 700Btc not appear in blockchain:   https://blockchain.info/address/1PPWBeauKVg3PahkbA3VXXS6zrfvfsMNJC

Are they stealing my money?  I ask someone for help.

[zeroday]

I see several transaction of 50 BTC each are dropping into your address today.
Probably it's gox. Guess they are just short of bitcoins now (typical fractional reserve shit).

https://blockchain.info/address/1PPWBeauKVg3PahkbA3VXXS6zrfvfsMNJC