What happened at MtGox? The Collapse of the World’s Largest Bitcoin Exchange

Only a year ago, MtGox was the largest Bitcoin (BTC) exchange in the world, handling 70 percent of all Bitcoin transactions. The exchange ground to a halt on February 7 when it was announced that all BTC withdrawals from customer accounts were indefinitely suspended. Left in the dark, thousands of Bitcoin owners found their assets frozen as the exchange shut down. To ease growing concern, MtGox stated that “the increase in withdrawal traffic [was] hindering [their] efforts on a technical level” and they needed the system to be in a “static state … to obtain a clear technical view of the current processes.”

MtGox’s customers were not satisfied with the explanation. The announcement was preceded by months of crippling delays and unfulfilled transfers. Trust in the company was already wearing thin after an ongoing series of blunders: the site had fallen victim to a successful hack in June 2011 and lost the equivalent of $8.75 million; federal authorities seized most of MtGox’s US-based accounts in mid-2013 due to compliance issues with financial regulations; and the exchange had been plagued by chronic withdrawal delays since April 2013. Even Roger Ver, a friend of MtGox’s CEO Mark Karpeles, recommended against the exchange. However, no one guessed the magnitude of the catastrophe that was about to surface.

Anybody who has enough information about what’s going on in the Bitcoin world … world not buy [their] bitcoins on MtGox.   ~* Roger Ver*

By late February, the world learned that more than 1 out of every 20 bitcoins in existence had disappeared from MtGox’s “cold wallet”. According to a “Crisis Strategy Draft” leaked on February 24, 2014, MtGox had just 2,000btc while customer deposits totaled to over 600,000btc. Over the course of two years, over 744,000 bitcoins worth more than $400 million USD had been stolen from the site.

Transaction Malleability

The core of the issue is a vulnerability called “transaction malleability”. Each bitcoin transaction has certain metadata, including information on how much is being traded and the identities of the sender and receiver of the coin. For identification of that trade, a transaction ID or “hash” is mathematically calculated using the contents that metadata.

However, not all of the metadata is secure. It is possible to change certain parts of the information stored in the transaction and, in turn, the transaction ID, without alerting the sender.

Transaction malleability in and of itself is not an issue; changing a transaction’s ID does not change the important parts of the trade, and the bitcoins still go to their intended recipient. However, a manipulated ID can throw off a system that’s built around the assumption that each transaction shows up under a particular ID, and the way this uncertainty is handled is crucial.

Unfortunately, when individuals withdrew from MtGox, the exchange’s software expected transactions to show up in the public ledger called the blockchain under the specific IDs it calculated at the time of the trade. This vulnerability gave hackers an opening to manipulate the hash and then claim their transactions had failed. Worse, MtGox’s system would automatically repeat the transaction in response to such a complaint, sending out bitcoins once again. Transaction malleability combined with MtGox’s system that depends on the validity of the hashes essentially allowed for double spending of coins.

Who is responsible?

Initially MtGox blamed the designers of Bitcoin itself. In a press release on 10 February, MtGox stated that they had identified a problem in the Bitcoin protocol “not limited to MtGox.”

However, the Bitcoin community has been aware of this vulnerability since at least May 15, 2011, and “transaction malleability” has been well-documented with its own page on the Bitcoin wiki. While transaction malleability is a weakness in Bitcoin itself, it can be and, by many other bitcoin services, has been neutralized by simple ID validation. The Bitcoin Foundation has acknowledged that this is a problem but argues that “any company dealing with Bitcoin … should responsibly prepare for this possibility”.

MtGox felt tremendous backlash from the Bitcoin community for their pushing the blame upon the bitcoin protocol. Kyt Dotson from SiliconAngle described MtGox’s response as a “blame-game” and attributed“technical ineptitude” for the withdrawal freeze. Alex Hern wrote in The Guardian that much of the blame also fell upon MtGox’s “almost unbelievably lax approach to accounting”.

“MtGox has allegedly never conducted a single audit of its customer deposits,” said Ryan Selkis, who leaked the crisis strategy document, “and it is believed that [MtGox CEO Mark] Karpeles may have been the only one within the company to have knowledge of how to actually tap the exchange’s cold storage. It remains unclear exactly how this type of storage leak could have happened over a multi-year period without any knowledge on the part of the executives at MtGox.”

Even the sloppiest of audits should have shown that something had gone wrong.  ~ Russell Brandom from The Verge

Emin Gün Sirer, an associate professor of computer science at Cornell University, thinks that the cause of the theft was less benign than simple incompetence. He said, “Whenever anyone is in a position of trust, whenever the illegal gains to be obtained from breaking that trust exceed the value of one’s reputation, there will be a temptation to steal. Jail is not quite a deterrent in this case, where the jurisdiction is Japan and the technology is too new for the justice system. Chances are that this is a simple case of theft, involving at least one insider.”

The Fallout

MtGox’s meltdown has affected the entire Bitcoin community. Once the world’s largest BTC exchange, MtGox filed bankruptcy, deleted its Twitter account, and shut down its trading platform. The exchange’s customers lost almost half a billion dollars overall. Customers have flooded the the Bitcoin subreddit with stories of retirement savings and college funds that were wiped out.

After repeatedly attempting to withdraw his BTC from MtGox, a Redditor who goes by the username CoinSearcher flew for 16 hours from his home in Australia to MtGox’s headquarters in Tokyo, Japan on Wednesday 5 February. He met with Gonzague Gay-Bouchery, MtGox’s Manager of Business Development and questioned him about the withdrawal delays. (“My protest at MtGox Offices”)

Initially, the wider community was anxious that MtGox’s collapse would put Bitcoin’s future in jeopardy. Hern said, “The MtGox losses … underscore the perception of bitcoin as a currency highly susceptible to bank robberies.” Indeed, when news came out, Bitcoin’s market price saw a major dip, plunging overnight to $405 from $612 as listed on another exchange, Coinbase.

MtGox’s leaked “Crisis Strategy Draft” noted, “With Bitcoin/crypto just recently gaining acceptance in the public eye, the likely damage in public perception to this class of technology could put it back 5~10 years, and cause governments to react swiftly and harshly. At the risk of appearing hyperbolic, this could be the end of Bitcoin, at least for most of the public.”

Despite these fears, Bitcoin has since recovered from the MtGox debacle. UK-based Bitstamp has taken up MtGox’s mantle as the world’s largest Bitcoin exchange; Bitcoin moves towards the mainstream as an increasing number of businesses accept Bitcoin as payment; and the price of BTC has floated back up. After losing his life savings during the MtGox meltdown, a man who goes by the username nmersulypnem on Bitcointalk said, “Ultimately, I still believe in cryptocurrency technology and how it will revolutionize the financial world; but it is clear that still has a lot of growing up to do.”