Mt Gox: Criminal or Careless?

In recent days, there have been a lot of contradictory reports about a large theft at the Mt Gox Bitcoin exchange. Their bankruptcy filing reported that USD $425 million worth of Bitcoins appear to have disappeared. Mt Gox has done nothing to clear up the confusion, which has led to ever more speculation about exactly what happened.

Much of the information that is being reported has been sourced to a document that has been published on the Internet. At this point, Mt Gox has not validated the document, but many reports believe it to be genuine.

Reports have centered around a known weakness in the Bitcoin infrastructure, known as "malleability." In attacks based on malleability, hackers slightly vary the information in packets about legitimate transactions and flood the exchange with fraudulent information. The exchanges then need to validate every transaction to see which transactions are valid. Most exchanges have built in safeguards to deal with attacks based on malleability.

Serious allegations are being raised that fraud within Mt Gox may itself have been responsible for at least some of the loss. In 2012, Mt Gox reported about USD $380k in revenue. But in 2013, the company had to pay out a USD $5 million fine. Financial reporters are not clear on how Mt Gox was able to keep its doors open after this fine, but there are several reports of slow payments after the fine was paid. Financial reporters have noted that some consider this to be an early warning of a company doing business on a fraudulent basis.

At the very least, it appears clear that Mt Gox continued to do business even after discovering that it was vulnerable to a hacking attack.