Looks like Mt. Gox is dead...

[Crusty]

Yea, what's the fucking story here? I thought that all BTC transactions are recorded and permanently stored as part of the "block chain". So let's look at the transaction history; where did all the coins go? This was a heist greater than any bank robbery in history - Where is the FBI?

Mt. Gox did not store their customers bitcoins on the blockchain. They maintained internal accounting software, or at least claimed to have.

Just one of the many reasons they were a shitty company.

 

[Mxylplyx]

Yea, what's the fucking story here? I thought that all BTC transactions are recorded and permanently stored as part of the "block chain". So let's look at the transaction history; where did all the coins go? This was a heist greater than any bank robbery in history - Where is the FBI?

You know what's nice about dealing in a currency backed by the weight of a multitrillon dollar economy, ie the USD? They create things like the FBI and the secret service, as well as any other apparatus at the disposal of the US government to defend the integrity of it. When someone steals a bunch bitcoins, why is that any different than someone stealing an island in second life, or a bunch of dragon armor in WOW? Should the FBI suddenly care about stolen bitcoins because a few idiots were stupid enough to pretend it was money?

 

[l0cke]

Err aren't ASICs turing complete?

I'm not an expert on it, but from what I've heard the advantage to using an ASIC isn't very big compared to a GPU.

http://en.wikipedia.org/wiki/Scrypt#Proof-of-work_in_cyptocurrency_operations

 

[Ns1]

They're still investigating the destruction-of-property complaints from the huge Eve battle of last month.

Lololol

 

[BoberFett]

You know what's nice about dealing in a currency backed by the weight of a multitrillon dollar economy, ie the USD? They create things like the FBI and the secret service, as well as any other apparatus at the disposal of the US government to defend the integrity of it. When someone steals a bunch bitcoins, why is that any different than someone stealing an island in second life, or a bunch of dragon armor in WOW? Should the FBI suddenly care about stolen bitcoins because a few idiots were stupid enough to pretend it was money?

Traditional fiat currencies are corrupt in their own ways, with rules that favor the well connected. (Maybe the Fed should step in and buy Bitcoins ) But governments enjoy the privilege of police powers that these non-government currencies will never have.

 

[halik]

You know what's nice about dealing in a currency backed by the weight of a multitrillon dollar economy, ie the USD? They create things like the FBI and the secret service, as well as any other apparatus at the disposal of the US government to defend the integrity of it. When someone steals a bunch bitcoins, why is that any different than someone stealing an island in second life, or a bunch of dragon armor in WOW? Should the FBI suddenly care about stolen bitcoins because a few idiots were stupid enough to pretend it was money?

DING. Thank you for being the voice of reason in this sea of Ron Paul tinhattery.

 

[BudAshes]

They're still investigating the destruction-of-property complaints from the huge Eve battle of last month.

Hahah, atot still has it.

 

[Mandres]

You know what's nice about dealing in a currency backed by the weight of a multitrillon dollar economy, ie the USD? They create things like the FBI and the secret service, as well as any other apparatus at the disposal of the US government to defend the integrity of it. When someone steals a bunch bitcoins, why is that any different than someone stealing an island in second life, or a bunch of dragon armor in WOW? Should the FBI suddenly care about stolen bitcoins because a few idiots were stupid enough to pretend it was money?

It's not money, but it's still a very valuable commodity that was stolen. It's exactly the same premise as a commodities brokerage disappearing overnight and running off with all the pork bellies.

 

[master_shake_]

as a favour to miners, im willing to give everyone who lost all their funny money, 10 cents on the dollar for any amd cards they would like to part with

 

[ImpulsE69]

On the plus side, what was a $365 million loss today could be only a $10,000 loss tomorrow (by bitcoin stability standards). Just look at it like your stock tanked into nothingness. You gambled, you lost.

 

[surfsatwerk]

It's not money, but it's still a very valuable commodity that was stolen. It's exactly the same premise as a commodities brokerage disappearing overnight and running off with all the pork bellies.

Pigs are real.

 

[Mark R]

Yea, what's the fucking story here? I thought that all BTC transactions are recorded and permanently stored as part of the "block chain". So let's look at the transaction history; where did all the coins go? This was a heist greater than any bank robbery in history - Where is the FBI?

This is a very interesting problem, and the answer is quite complicated. This is what I have been able to gather from public sources, held together with various deductions and educated guesses.

1. Mt Gox is an exchange. You can deposit or withdraw legal currency and trade for BTC or vice versa.

2. There is by necessity a pool of BTC and legal tender held at Mt Gox in place of client funds. In the case of BTC, a customer would pay BTC from their wallet to Mt Gox's wallet address, and the opposite would happen for withdrawal.

3. While BTC payments are public via the blockchain, the exchange of legal tender for BTC is not a blockchain transaction and therefore not public and only logged internally in Mt Gox's database (although summary information - e.g. trade price and volume - is published).

4. The deposit of BTC into Mt Gox and withdrawral out are part of the blockchain and are publicly logged.

5. Mt Gox wrote custom "wallet" software to handle the BTC transactions on the blockchain. It had a serious bug, in that the payment instructions it generated were malformed.

6. The malformed transactions would be accepted by early versions of the official bitcoin client, and the transactions would work correctly. However, the hash of the transaction data (often used as a "unique ID") would be different in a malformed transaction compared to a correctly formed one.

7. The bitcoin developers realised that this would be a problem, and pushed out an update that would automatically reject malformed transactions, even if otherwise correct and signed. They also sent out an alert to developers telling them that the transaction hash must NOT be used for tracking the progress of transactions (because if two copies of the same transaction, one well formed, one malformed had different hashes, and you only look for one hash, then you may think the transaction had failed, when it had in fact, completed).

8. Mt Gox failed to implement this when the update was pushed out in Jan 2013. As a result, BTC withdrawals from MtGox would fail. MtGox internal developers were unable to identify the problem.

9. 3rd parties unknown (possibly hackers, possibly frustrated customers of Gox trying to withdraw BTC, possibly benevolent 3rd party bitcoin proponents) set up "workaround" servers. These would pick up the malformed transactions from Mt Gox when they were broadcast, and they would reformat them into the correct format required by the blockchain and then rebroadcast them. The blockchain would ignore the malformed broadcasts, but accept the reformmated broadcasts.

10. Not only had Mt Gox not noticed the bitcoin protocol update, but they had also not heeded the warning of the bitcoin devs to be certain that they are not using transaction hashes for checking transaction progress.

11. The Mt Gox wallet software used the transaction hashes as the ONLY method of reconciling transactions. The blockchain was never rescanned to check that coins were in their expected places, and the coins were never traced as part of transaction validation. (This contrasts with the reference source code, which reconciles transactions by tracing the coins as they progress through the blockchain).

12. Over the next 12 months, confusion reigned at Mt Gox and they had no idea why sometimes customers would complain about not receiving transactions, and that they could not find the transaction hashes in the blockchain.

13. To Mt Gox's wallet software the transaction might appear to have failed (because the hash would never appear in the blockchain due to the transaciton being malformed). The same would be true for Mt Gox support, who would search for the transaction hash on blockchain.info and not find it. As a result, support would reissue the transaction without any further checks (e.g. checking the receiving address on blockchain.info for receipt of coins, or checking the MtGox wallet address for withdrawal of coins)

14. There appears to have been mass exploitation of this lack of checks. Some customers are believed to have noticed that they received their withdrawals, but that the transaction was showing as failed on Mt Gox, and that they had the "wrong" transaction hash listed. Some customers may then have gone and received double or triple payouts from support by claiming that the coins never arrived.

15. It appears that there was no auditing of this over the 12 month period when all withdrawals would have been subject to this bug (and possible several years previously, as the hash "malleability" bug was first noted in 2011, and the developers started warning software devs about it)

16. Mt Gox held a limited size "hot" wallet for day-to-day BTC use. The vast bulk of their BTC were held in a stack of "cold" wallets that would hold their long-term customer deposits in an offline/nearline format.

17. On Feb 7 2014, Mt Gox were finding that no more BTC withdrawrals could be made. From what i can tell, this is because their "hot" wallet was empty. The status of the "cold" wallets is unknown, but they are rumored to be depleted also.

18. It is presumed that they had either an automated system or a manual process with no checking for transferring BTC from "cold" to "hot". This appears never to have been audited or subjected to checking.

19. New MtGox customers would have had to supply scans of passport/photo ID/proof of address/residency. However, it is possible that old customer accounts might not have needed this, especially if they never tried to deposit or withdraw legal tender (i.e. only move BTC in and out for speculation purposes).

20. While it should be possible to trace customers that have received multi-payouts, this depends on support having kept adequate records. Given the vast number of transactions in and out of Mt Gox, it may not be possible to correlate transactions to find duplicates, especially if a different BTC address was specified for the 2nd or 3rd attempt.

21. Even if customers could be traced, there is still the issue of trying to get the BTC back. This may not be practical as the legal costs would be substantial, and probability of success may be limited.

22. In summary, the coins have probably been paid out incorrectly to a number of customers, some by luck, but probably most by deception. However, this depended on seriously buggy software at Mt Gox, despite specific warnings from the bitcoin devs that it needed fixing, total lack of auditing of their customer deposit holdings, and lack of investigation into apparent technical failures and unusually frequent calls to support for "missing" withdrawals.

23. Given that it is very likely that internal controls were very, very lax - it is also a possibility that insiders may have exploited some of the bugs, e.g. support staff may have twigged that there was a potential exploit, and they may have been able to set up accounts under false names or where the legal paperwork had been "lost".

 

[ImpulsE69]

And again we will say....anonymous virtual currency with no real backing. What could possibly go wrong?

If you think this would stop at Mt Gox, you'd be sorely mistaken. Those exchanges aren't into it out of the goodness of their hearts. Even if it wasn't them, being the biggest will make you a target. You don't think others will try similar things to other exchanges?

 

[Rakehellion]

Tinfoil hat time: What if this were an NSA-led operation to crash bitcoin and limit the possibility of it becoming a viable currency outside the control of the US banking system?

That would be stupid. You don't make money by burning money.

 

[Rakehellion]

Maybe the Fed should step in and buy Bitcoins

They still have millions to sell from the Silk Road shutdown.

 

[MrScott81]

This is a very interesting problem, and the answer is quite complicated. This is what I have been able to gather from public sources, held together with various deductions and educated guesses.

1. Mt Gox is an exchange. You can deposit or withdraw legal currency and trade for BTC or vice versa.

....

23. Given that it is very likely that internal controls were very, very lax - it is also a possibility that insiders may have exploited some of the bugs, e.g. support staff may have twigged that there was a potential exploit, and they may have been able to set up accounts under false names or where the legal paperwork had been "lost".

I'm not sure if this is 100% accurate, but thank you for the amazing summary! Very interesting. I have long watched bitcoins but never put any money into it, and this makes me really glad I didn't

 

[IAteYourMother]

There are benefits, and there are drawbacks to a decentralized currency.

 

[Crusty]

I'm not sure if this is 100% accurate, but thank you for the amazing summary! Very interesting. I have long watched bitcoins but never put any money into it, and this makes me really glad I didn't

It's accurate from what information is public as far as I can tell.

 

[Ns1]

I wonder how many of these are true

http://www.reddit.com/r/Bitcoin/comments/1yv26o/gox_horror_story_thread_how_much_did_you_lose/

About 1998 BTC. This was BTC I had in Bitcoinica until Zhou Tong decided to rob his own customers blind. Amir Taaki and the Bitcoin Consultancy group then sent the remaining BTC into MtGox for reimbursement where they promptly got hacked again resulting in insolvency. Late 2012 Bitcoinica was finally sent into liquidation but MtGox was unwilling to hand over the 60K+ BTC frozen in the Bitcoinica account to the court appointed liquidator (PKF) citing 'privacy reasons'. Now all of those are gone too. Despite all this, I'm still a believer in Bitcoin. (Just not so much other people)

 

[waggy]

I feel bad for the people who lost money. but damn. why are people surprised?

 

[FallenHero]

You certainly can, but there is no reason for that to happen ever.

You can print out paper wallets where there is no trace of the wallet 'online' and secure them physically, this is known as cold storage and is akin to storing cash in a safe.

There is no reason to rely on a 3rd party to store and secure your Bitcoins. That kind of defeats the whole benefit of being decentralized.

You should keep a 'hot' wallet that is easily accessible that you replenish from your cold storage every so often when you run out of funds.

You wouldn't walk around with your entire bank account in your back pocket would you? Well, then you shouldn't store all your Bitcoins in one place or in a place that is accessible by millions of people(the Internet).

I see you've never heard of debit cards.

 

[sandorski]

The Invisible Hand at work. Unfortunately it's somewhat Klepto.

 

[dr150]

Guy on the right....down $300k...

http://www.theverge.com/2014/2/19/5425220/protest-at-mt-gox-bitcoin-exchange-in-tokyo

 

[ImpulsE69]

I have to ask, when you say "lost $300k" does that mean they invested 300k or that they just lost 300k in "current bitcoin valuation" because...there's a big difference.

 

[Suspicious-Teach8788]

Oh and

regardless, it is a big deal that this happened. A HUGE deal. Yeah bad apples need to be weeded out, but this is like game of thrones style weeding.

When was this dated? Plus, a lot of the volume on MtGox in the past weeks were meaningless. People tried to capitalize on the collapse and since their money was in, they tried to play around with it.

Essentially most people who knew what they were doing (which is very few people here), who actually matters in terms of Bitcoin, already got their money out of MtGox long time ago.