750K BTC - Where Did It Go?

[lorix]

Let's assume that the situation as we currently understand it is correct - that MtGox has indeed lost in the order of 750,000 BTC due to theft via malleability exploit.

The question I haven't seen asked yet is WHO might have been responsible for this and does this mean there is someone out there with 750K coins hidden away?

Possible - yes, but unlikely.

If we take a step back and look at things - the theft occurred over an extended period where unknown parties drained the hot wallet on a regular basis, which was then being topped up from their cold wallet. Rinse and repeat. This combined with the fact that BTC was worth a lot less a couple of years ago makes one think the perpetrator probably took the bulk of the coins early on when BTC value was significantly lower. I wouldn't be surprised if they reduced their "take" over time as the price rose to keep under the radar.

MtGox previously stated they had accounts flagged for suspicious activity so hopefully transaction records will be made public as a matter of course and allow us to confirm if this was the case or not. Whether or not this was one person or several, I've no doubt the thieves stashed away a nice chunk of BTC but it's doubtful they held onto a truly phenomenal amount. Most likely they tumbled and sold the bulk of them over time as they went, human nature being what it is.

Regardless, if this results in fewer coins being dumped on the sell market each week then it's a good thing!

Thoughts?

[clearcrystal]

Satoshi

[BitCoinNutJob]

https://blockchain.info/address/1Drt3c8pSdrkyjuBiwVcSSixZwQtMZ3Tew?currency=MBC

[Swordsoffreedom]

https://blockchain.info/address/1Drt3c8pSdrkyjuBiwVcSSixZwQtMZ3Tew?currency=MBC

WOW That is was a lot sitting in one address (Not touched since February)  

[maaku]

https://blockchain.info/address/1Drt3c8pSdrkyjuBiwVcSSixZwQtMZ3Tew?currency=MBC

WOW That is a lot sitting in one address (Not touched since February)

You realize (1) it's empty, and (2) it's bitstamp not mtgox?

[Swordsoffreedom]

https://blockchain.info/address/1Drt3c8pSdrkyjuBiwVcSSixZwQtMZ3Tew?currency=MBC

WOW That is a lot sitting in one address (Not touched since February)

You realize (1) it's empty, and (2) it's bitstamp not mtgox?

1. Didn't notice I just saw the receivable input did not look at the output 2. Presumed it was a gox address due to the recent news and did not know it was a bitstamp one actually
Thanks for that

[btbrae]

the theft occurred over an extended period where unknown parties drained the hot wallet on a regular basis, which was then being topped up from their cold wallet. Rinse and repeat.

I'm not buying that. No way that they didn't regularly check the cold wallet balance, they would see the funds going down quite quickly. There is something more to it or it is a plain Ponzi and the malleability bug was just a way to cover it up. Or am I misunderstanding the way cold wallets work?

[Beymond]

In mtgox pocket 

[nicekettle]

The stolen coins most likely were immediately sold. If that's the case, tracking them would be useless, they are in hands of thousands of people who have nothing to do with the theft.

[Lloydie]

Let's assume that the situation as we currently understand it is correct - that MtGox has indeed lost in the order of 750,000 BTC due to theft via malleability exploit.

The question I haven't seen asked yet is WHO might have been responsible for this and does this mean there is someone out there with 750K coins hidden away?

Possible - yes, but unlikely.

If we take a step back and look at things - the theft occurred over an extended period where unknown parties drained the hot wallet on a regular basis, which was then being topped up from their cold wallet. Rinse and repeat. This combined with the fact that BTC was worth a lot less a couple of years ago makes one think the perpetrator probably took the bulk of the coins early on when BTC value was significantly lower. I wouldn't be surprised if they reduced their "take" over time as the price rose to keep under the radar.

MtGox previously stated they had accounts flagged for suspicious activity so hopefully transaction records will be made public as a matter of course and allow us to confirm if this was the case or not. Whether or not this was one person or several, I've no doubt the thieves stashed away a nice chunk of BTC but it's doubtful they held onto a truly phenomenal amount. Most likely they tumbled and sold the bulk of them over time as they went, human nature being what it is.

Regardless, if this results in fewer coins being dumped on the sell market each week then it's a good thing!

Thoughts?

The MtGox liability to customers and itself is 750,000 coins. i.e. MtGox sold 750,000 coins kept on its internal system as an IOU.

The cold wallet of unknown amount is MIA but presumably less than 750,000 coins.  The drained amount of real Btcs is unknown.

[Sheldor333]

Best answer I've seen so far can be read here. CNN writer explains in detail how it couldn't be a bitcoin protocol fault
http://money.cnn.com/2014/02/25/technology/security/mtgox-bitcoin/index.html?hpt=hp_t1&cdn=564

[lorix]

the theft occurred over an extended period where unknown parties drained the hot wallet on a regular basis, which was then being topped up from their cold wallet. Rinse and repeat.

I'm not buying that. No way that they didn't regularly check the cold wallet balance, they would see the funds going down quite quickly. There is something more to it or it is a plain Ponzi and the malleability bug was just a way to cover it up. Or am I misunderstanding the way cold wallets work?

I know, it didn't sit well with me which is why I said at the start of the post let's just assume it's correct. In reality I can't imagine the red flags going up sooner with proper accounting in place. In the case of the hot wallet getting refilled, I can only assume there was a semi-automated system in place to top it up on a regular basis and they didn't use a truly "cold" wallet. Perhaps a semi-automated offline system was in place to sign replenishment transactions and nobody bothered to audit the daily transaction lists.

We can only hope that a newly unemployed staff member might be on these forums and able to shed some light on what was really going on behind the scenes there.

[rohnearner]

Best answer I've seen so far can be read here. CNN writer explains in detail how it couldn't be a bitcoin protocol fault
http://money.cnn.com/2014/02/25/technology/security/mtgox-bitcoin/index.html?hpt=hp_t1&cdn=564

it informs about what is happening around but not explaining what exactly mtgox will go through but then again that would only be speculation .!

[DeathProxy]

I'm sure the 750k btc is in karpales wallet. 

[frito]

The stolen coins most likely were immediately sold. If that's the case, tracking them would be useless, they are in hands of thousands of people who have nothing to do with the theft.

IF sold you can track them to accounts at other exchanges.

It is kinda in all exchanges best interest to cooperate and help find the perps.

[pengoau]

if its a exploit with the coin why aren't other exchanges affected?

or is it a exploit with mtgox'es exchange software (so other exchanges/btc is fine)?

[TrailingComet]

It is hard to buy into the argument that Gox was merely incompetent and not criminal

More to this than meets the eye

[pengoau]

Incompetent criminal.

The chat logs, make me think its just incompetence that caught up to him.

[lorix]

Just read the following article being linked to on Digg:

http://www.theverge.com/2014/2/26/5450206/who-stole-400-million-from-mt-gox

This article mentioned with staff turnover there the past few years the possibility exists that this was an inside job. If true, that could certainly explain why something like this would go unnoticed for so long - eg: a report that does a realtime lookup of a cold wallet's current value is replaced with a static value to make it appear it hasn't been touched.