Crowd Detectives reveal MT.GOX Bitcoin Heist as Inside Job

By Rick Falkvinge: Thousands of volunteering and self-organizing detectives have been meticulously laying a puzzle that reveals the Gox billion-dollar heist as an inside job. As smoke clears on the implosion of the Empty Gox bitcoin exchange, thousands of people in the community committed to revealing the truth behind the stonewalling exchange. What was claimed first to be a technical problem, then an outside theft, has been conclusively determined that the MtGox management knew too much, too long ago, to have this be an ordinary case of theft.

There are still many question marks remaining surrounding the missing 744,408 bitcoin at Empty Gox, valued at their peak to just under one billion US dollars, and which are well north of that in replacement value on the open market today. What’s becoming clear, though, is that this wasn’t a theft that properly shut down operations as soon as it was discovered. Instead, Empty Gox and its CEO Mark Karpeles appear to have attempted to benefit and profit from it. That would cross the line into criminal complicity, even if they were not part of the original loss – something that also remains an open question.

At this point, there are two outstanding principal questions:

Who took the money?
When was the money taken?

Let’s address the second question first and get the timeline in order, because it completes a lot of the puzzle. I have written before that it would be absolutely impossible to not notice the loss of one billion dollars from company assets, unless you were actively cooking the books to hide a gaping hole where a billion should have been. As it turns out, it seems such fraudulent cooking is exactly what has taken place.

An attempt at a timeline

Many different people have been working diligently to put together a timeline of events. Here’s an attempt to summarize the most important and credible ones.

June 2011 – the first possible time when the bitcoin in question might actually have disappeared (Jesse Powell). If true, Empty Gox has been operating with a lack of assets since, attempting to gradually cover the huge hole in its assets though operating profits. This would explain why there aren’t any books or balance sheets at all (Roger Ver), since making them would disclose the empty vault. Obviously, failing to disclose this would probably be at least criminal neglect toward shareholders, and quite possibly toward financial authorities as well.

August 2013 – First rumors that everything isn’t financially well with Empty Gox. Trouble with US Dollar withdrawals due to August 13 seizure of funds by US government. Nothing solid at this point, but in hindsight, this is when the game of musical chairs started (Weiner). The fractional reserve that was initiated some time 2011 has been holding up until this point.

October 20, 2013 – First report of a withdrawal from Empty Gox that didn’t go through, like an ATM executing a withdrawal but not dispensing any money. The stuck withdrawals are technically diagnosed by the community to be caused by an attempt at Empty Gox of spending the same money twice, which suggests that the Gox software believes it has money that it actually doesn’t. This is the date when Empty Gox management, at the latest point possible, must have been acutely aware that it was unable to serve withdrawals due to lack of funds. (Bryce Weiner)

December 2013 – People’s Bank of China announces an end to Chinese bitcoin trading by February 1, 2014. This causes Chinese to withdraw from Empty Gox in large numbers, depleting the reserves.

January 2014 – I try to empty my account at Gox. Bitcoin withdrawals are not coming through. It’s like emptying your account at an ATM but only getting dispensed a fraction of the money out of what was listed as withdrawn. Still not a large issue in the forums; you have to dig deep to find some technical discussion threads analyzing the withdrawal problems. Complaints to Gox get answered well after a week, at which point the balance is restored, and new withdrawals fail the same way. Rinse and repeat.

February 1, 2014 – Following the People’s Bank of China edict that times out on February 1, the amount of stuck withdrawals at Gox goes stratospheric enough for independent people to start tracking them on charts for debugging purposes.

February 4, 2014 – I publish my “38 million dollars missing at Gox” article, which is the first article to convert the question from a technical to a financial one, as far as I know. Several people would contact me after that article and hint that the situation was much worse than I could imagine.

February 7, 2014 – Gox shuts down bitcoin withdrawals entirely, blaming problems with the bitcoin protocol as such, so-called “transaction malleability attacks”. This is immediately identitied as technical bullshit by a number of heavy names, plus myself. Gox promises an update on February 10.

February 9, 2014 – First recorded event of an actual transaction malleability attack against the blockchain, two days after Gox had been blaming such attacks for all problems up until now. This contrasts with the fact that failed withdrawals occurred as early as October 20, 2013. (Weiner)

February 10, 2014 – Empty Gox issues a non-update to the situation, not giving a date for when its next update will follow. A few hours prior, there had been a massive selloff of coins on Gox, sending the price from $300 to $150, strongly suggesting insider trade (read: obviously showing).

Through February – People observing Gox actions remain hopeful at the slightest activity that things will sort out well in the end; some technical developments do take place. Meanwhile, the exchange rate of bitcoin tanks, especially on Empty Gox which is now isolated from the rest of the bitcoin economy. The exchange rate plummets from $1,000 per coin to sub-$100 per coin on Gox, and to about $600 on other exchanges. Allegedly, Karpeles is acting to profit personally from this difference in price, which is directly caused by his own mismanagement and shareholder deception, through active arbitrage (Selkis).

…Karpeles knew about the pervasive damage of the transaction malleability attacks for several weeks and was engaging in an arbitrage scheme that leveraged the depressed Mt. Gox price to reap gains on other exchanges. This was allegedly happening well before [February 25].

February 24, 2014 – A crisis strategy draft leaks, courtesy of Ryan Selkis, that indicates there has been a leak from Gox’ cold storage, leaving a hole of 744,408 bitcoin. As Andreas Antonopoulos points out, a “leak” from “cold storage” is a contradiction in terms: that means it either wasn’t a leak or it wasn’t cold storage. This document makes it clear that Empty Gox management knew that the problem wasn’t technical, and that they knew well what was going on:

For several weeks, MtGox customers have been affected by bitcoin withdrawal issues that compounded on themselves. Publicly, MtGox declared [...technical problems with the bitcoin protocol...]. [...] The truth is that the damage had already been done. At this point 744,408 bitcoin are missing…

February 25, 2014 – Empty Gox website goes completely blank. The music stops. This is consistent with the timeline presented in the “Crisis Strategy Draft” leaked the day before. The bitcoin exchange rate plummets to $400 per coin.

February 26, 2014 – The exchange rate of bitcoin has recovered completely from the shock of Empty Gox closing, back up to $600 per coin. Erik Voorhees notes that the bitcoin price fell less after the Gox implosion than the US equities fell after the Lehman implosion, which puts things in perspective. (Voorhees)

February 26, 2014 – Mark Karpeles posts a statement on the Gox website stating he is still in Japan and working to resolve the “recent issues” (see screenshot).

February 27, 2014 – Mark Karpeles’ neighbors say he moved out of his apartment in Tokyo a month ago (Kolin Burges).

February 27, 2014 – The 2014-2017 business plan of Gox leaks, courtesy of Ryan Selkis. It confirms the leaked document from February 24, and notably lacks any balance sheet. It reads very much like a prospectus aimed at courting buyers.

February 28, 2014 – Empty Gox files for bankruptcy protection, according to the Wall Street Journal (breaking at the time of writing).

This timeline, when seen from a zoomed-out perspective like this, paints a clear picture of a company – or at least a management – that was well aware of an insolvency, trying to actively deceive the community and shareholders, and profit personally from doing so.

Who took the money?

So, the trillion-dollar question: who took the money? Strictly speaking, we don’t know that yet. We’re talking about a sum of money so large that “humongous” and “enormous” aren’t sufficient to describe it – it’s 6% of all bitcoin in existence, and assuming bitcoin keeps growing to its potential, that means one individual is sitting on 6% of the world’s future trade and retail currency supply. In today’s USD value, such an amount would be on the order of 20 trillion US dollars, or roughly 250 times the fortune of today’s richest billionaire. It’s not exactly hard to see a motive here.

If this happened in the 2011 hack, then frankly, we have no idea. There are rumors floating around that Karpeles just lost the keys to the vault, that Gox has money stashed away, that the billion dollars are “temporarily unavailable”, and while an admirable theory to get hopes up that those keys may be found again, the zoomed-out picture says very clearly no such thing has happened. Somebody managing a company like this and treating it like his personal toy would have a personality that could well hint at all the money being just around the corner if you would only make a few more trades, acting just like any Prince of Nigeria. There is also unconfirmed research suggesting that Karpeles is in personal control of a very large amount of bitcoin (424,000) once used in the operations of Empty Gox; this research can be expected to be peer reviewed over the coming days. But no matter whether Karpeles personally robbed Gox blind, or profited personally on continuous deception from somebody else doing so in 2011 while deceiving clients and shareholders, it is clearly over the line into criminal territory and definition of an inside job.

In order to further boost hope in returning the money, there have been rumors of a buyout, apparently planted by Karpeles himself. Such rumors, getting hopes up that the client funds would be restored, turned out to be nothing but delusional bailout dreams from CEO Karpeles, as I predicted in my last article – while I understand the hopes of a competent management buying Gox, as I wrote, that’s a contradiction in terms. No competent management is going to go anywhere near this toxic crater. Instead, as revealed by bitcoin entrepreneur Ryan “Two-Bit Idiot” Selkis, once the businesses thus approached understood the magnitude of fraudulent mismanagement, they immediately notified authorities.

The silence from MtGox in general and its CEO Mark Karpeles in particular is stunning – and concerning – in this situation. A billion US dollars of clients’ money is missing, and the only public statement amounts to “stop asking us questions”.

In the first and only interview so far after the still-officially-unexplained shutdown, which has already led to multiple tragic suicides over the loss of fortunes, CEO Mark Karpeles responded to questions with a picture of his cat. This means that the communications skills from MtGox and Karpeles are either so carefully orchestrated here that only an experienced genius would understand them, or so incompetent that it falls below any description. Take a guess which is more probable.

According to research by Bryce Weiner, Karpeles himself is the person who took the funds, and this happened in 2011, which would be consistent with the observation by Jesse Powell (Weiner): “There’s nothing to indicate that Empty Gox was ever solvent.” While the timeline doesn’t conclusively show that Karpeles himself is behind the original disappearance of funds, it does show clear complicity in profiting from the heist.

As this article is almost finished, the Wall Street Journal reports that Empty Gox has just filed for bankruptcy.
Copycat Scam?

According to an anonymous high-profile source, the first and original bitcoin scam was the online coin wallet People would deposit hundreds of thousands of coins there, as the currency was new and hundreds of thousands of coins weren’t yet worth a lot.

Then, on July 29, 2011, the site went blank, just like the Gox website did. People panicked and gradually accepted a catastrophic loss of funds.

On August 11, 14 days later, the site came back online and declared – just like Gox – that they “had been hacked”, had filed for bankruptcy protection, just like Gox, but “had managed to recover” 49% of the funds. People could fill out claim forms to recover these funds. As this was enough time for most people to internalize the loss, they were happy again at the sudden windfall; things suddenly weren’t as bad as they had seemed. In the meantime, the anonymous person who ran disappeared with a huge amount of money, according to the source.

In other words, the scam cynically exploited people’s loss and grief to actually make them happy when they got something back. Most “hacks” of bitcoin sites since then have actually been copycat scams of, again according to this source. If – repeat, if Empty Gox is executing a copycat scam, we should expect the site to offer their clients a portion of the holdings back, a portion probably lower than 50% (just to drive the point home), and that offer should appear on or about March 11, 2014. Time will tell.

The one key difference between and MtGox would be that Mark Karpeles is not anonymous, which would make for a very poor execution of a copycat scam.


Another very interesting theory is posted in the comments section at the previous link : CryptoCoinUser • 21 hours ago

Ahem, what about my theory that MtGox is now a puppet of some fiat power(s) due to blackmail or outright threats of violence, hence nothing makes sense? The transactions don't match the written statements - something the puppet masters could have easily overlooked. The "leaked" docs from MtGox as well as Karpeles's recent typed statements could have been essentially done at gunpoint. When was the last time Karpeles appeared in public to make a statement face to face? Thanks for doing all these forensics, however. I'm all for not jumping to conclusions, but IMHO nothing else makes sense. Karpeles is no poker-faced conman like Bernie Madoff to bluff for years, nor is he totally incompetent to loose 1000's of BTC. Plus I think we're overdue for some black-ops / psy-ops covert action from the fiat powers that have a LOT at stake here. The previous four mini-goxings (that I agree were just sheer incompetence) would provide perfect cover for this Mega-goxing.

FROM REDDIT.COM: [Speculation] The US Government has control of Gox's cold wallet.
Recent testimonies by federal agencies indicate that the account seizures were in fact related to the multi-year pursuit of Silk Road operators, rather than a crackdown on money transmission infractions for their own sake.


Looking backwards, it’s clear why the Silk Road connection couldn’t be noted in any court filings that would become public. If federal agents made known at the time that they were actively pursuing Silk Road it could interfere with their ongoing investigation. This also means that, at least in this case, it appears money transmission laws were enforced on Mt. Gox not simply for their own sake, but to gain insight and hinder the capital flow to Silk Road without exposing the larger goal of shutting down the international narcotics marketplace.

Maybe I'm insane but here's a possibility: A clear link was established between Silk Road and Mt. Gox. Significant portions of the cold wallet are now frozen. (Yes, the US still has a lot of pull in other countries eg Japan. Think Kim Dotcom. Plus Gox is a registered entity in the United States.)

Transaction Malleability did steal a portion of bitcoins, but not the insane 99.7% amount. Gox is now unable to refill their hot wallet due to the seizure. They are now aiming for an acquisition to cover the funds stolen by transaction malleability, however a gag order prevents Gox from disclosing exactly why the funds are missing, hence for the time being they blame it on Transaction Malleability.

Gox likely had a tiered system of "hot wallet", "cold wallet" and "coldest wallet". It's possible the US Gov took control of the "coldest wallet", which would contain the largest amount.

Gox is possibly now working on some type of 3-way full tilt poker style acquisition deal (Gox, new owners, US Gov) which will result in funds being returned plus a drop in pending charges (which could be sealed).

All pure speculation, but I'm curious as to if you guys can think of anything else that ties this theory together?