Can someone post a concise answer as to the exact problem with Mt. Gox and whether the others have the problem or not.
Before that, please just be aware that transaction malleability is considered undesirable and irritating, but as far as we know everyone checked their systems weren't affected by it and moved on a long time ago.
Everyone except MtGox, who blamed it for their extensive downtime and continue to blame it for a massive loss of their btc funds. We currently have no way to know if those claims are genuine. The pattern you should be getting here is of consistent failure and lack of followup by MtGox.
1. The Bitcoin protocol has a transaction ID, which can be changed shortly after transaction initiation (but not after the transaction is confirmed?)
Correct.
2. Mt. Gox used this transaction ID for their internal accounting, while others claim that they do not use it to identify transactions.
Correct.
Some exchanges and other bitcoin services halted withdrawals, either to check their implementations or to fix their implementations. They were back in operation within a couple of days.
3. Mt. Gox customers would do a withdrawl, change the transaction ID, then complain to customer service that they didn't receive their coins. The Mt. Gox system was fooled because of using the transaction ID, and then customer service would send the coins again.
We don't know exactly how any scam at MtGox worked, because no one has put out a statement yet. There have been some rumours that MtGox has, through its poor implementation, consistently had problems creating valid transactions, so they lashed together an automated resubmit of any transaction that they thought had failed, thus enabling a massive draining of funds via transaction malleability. This is hearsay.
Karpeles has claimed that 750k BTC have been stolen. He hasn't said if they were stolen through transaction malleability. This is obviously a fantastically large amount of BTC to lose by any means. But MtGox has lost a further 500,000 to thieves in the past. The community never got a straight answer over that either.
1) This is known in the bitcoin software.
2) Proper accounting systems do not use the transaction ID to track payouts.
It was known about for several years but not really considered important. Once MtGox mentioned that it was a problem, someone began indiscriminately attacking the network with mutated transactions which caused failed transactions for a lot of people, and then people took it more seriously, and fixed their stuff.
It's impossible to say there are no bugs in software. Even software you have the source of.
No known other exchanges have the problem (or if they do, they're not saying).
They shouldn't do, as they all had opportunity to check by now. But malleability is not the main problem with MtGox or any other exchange or service provider. The problem is they're completely unregulated and you have to trust them with your bitcoins. They can shut down at any time and take your bitcoins. Or claim they are the victim of theft.
Malleability is just what MtGox are using as an excuse today. Even if transaction malleability
was used to steal from them, 750k BTC over a period of years should have been noticed. Should have been noticed monthly if not daily. Keeping a ledger is basic business 101 at a corner store level, not a $100mil currency exchange.
Here is more from Andreas M. Antonopoulos:
http://antonopoulos.com/2014/02/25/statement-on-mt-gox/
