Skip to main content

This site is for educational purposes only. Nothing here constitutes financial advice.

Back to all case studies
Exchange Collapse
2014-02-28~850,000 BTC (~$450M at the time; $50B+ at 2024 prices)

Mt. Gox Collapse

February 2014 — at the time the largest Bitcoin exchange in the world goes bankrupt with ~850,000 BTC missing. Recovery proceedings continue a decade later.

Mt. Gox (an acronym originally for 'Magic: The Gathering Online Exchange') was the dominant Bitcoin exchange in the early 2010s. At its peak in 2013, it handled approximately 70% of all Bitcoin trading volume globally. The exchange was founded by Jed McCaleb in 2010 (he sold it to Mark Karpelès in 2011), and was based in Tokyo, Japan.

On February 28, 2014, Mt. Gox filed for bankruptcy protection in Tokyo, citing the loss of approximately 850,000 BTC — about 7% of all Bitcoin in existence at the time. The cause was a years-long withdrawal of customer deposits by an attacker (or attackers), exploiting vulnerabilities in the exchange's transaction tracking and (in some accounts) participation by insiders.

Mt. Gox remains the longest-running bankruptcy proceeding in crypto history. Initial distributions to creditors began in 2024 — a decade after the collapse — and the case is widely cited as the foundational example of why self-custody matters for any meaningful Bitcoin holding.

Timeline

  1. 2010-07
    Mt. Gox launched by Jed McCaleb as a Magic: The Gathering card trading platform; pivoted to Bitcoin.
  2. 2011-03
    Mt. Gox sold to Mark Karpelès. By this date approximately 80,000 BTC had already been stolen (later admitted).
  3. 2011-06
    First public Mt. Gox security incident; 25,000 BTC stolen. Karpelès reimburses customers from exchange reserves.
  4. 2013-05
    US Department of Homeland Security seizes $5M from Mt. Gox's Dwolla account citing unlicensed money transmission.
  5. 2013-06
    Mt. Gox suspends USD withdrawals citing 'technical issues.' Withdrawal delays become chronic.
  6. 2014-02-07
    Mt. Gox suspends all Bitcoin withdrawals citing 'transaction malleability' bug.
  7. 2014-02-24
    Mt. Gox goes offline entirely.
  8. 2014-02-28
    Mt. Gox files for bankruptcy protection in Tokyo. Admits loss of approximately 850,000 BTC.
  9. 2014-03-20
    Karpelès announces 'discovery' of 200,000 BTC in a 'forgotten' old wallet. Total missing now ~650,000 BTC.
  10. 2015-08
    Karpelès arrested in Japan on charges of embezzlement and falsifying records.
  11. 2017-07
    Russian national Alexander Vinnik arrested in Greece on charges of laundering ~$4B through BTC-e, including a large fraction of stolen Mt. Gox BTC.
  12. 2019-03
    Karpelès convicted of falsifying records but acquitted of embezzlement; receives suspended sentence.
  13. 2021-11
    Tokyo District Court approves civil rehabilitation plan; creditors to receive BTC + BCH rather than fiat at 2014 prices.
  14. 2024-07
    First wave of distributions to Mt. Gox creditors begins — 10+ years after the collapse.

Mechanism

The thefts were ongoing for years. WizSec analysis (a Mt. Gox-focused forensic blog) determined that significant Mt. Gox holdings had already been compromised by mid-2011, before Mark Karpelès took ownership. The thefts continued, undetected internally, through 2013. The total of approximately 850,000 BTC was the cumulative loss over roughly four years, not a single event.

Internal tracking failures masked the losses. Mt. Gox's internal accounting was fundamentally broken. Customer balances were tracked in a database that wasn't reconciled against actual on-chain holdings. Internal 'hot wallet' to 'cold wallet' movements were not properly logged. The exchange was unable to know, at any given moment, how much Bitcoin it actually held versus how much it owed customers.

The 'transaction malleability' cover story. When Mt. Gox suspended withdrawals in February 2014, Karpelès publicly blamed a known Bitcoin transaction-malleability bug — a real technical issue that allowed an attacker to claim a withdrawal had failed and request it again. Subsequent investigation showed that transaction malleability could account for at most a tiny fraction of the missing BTC; the bulk had been stolen years earlier by other mechanisms. The malleability story was a convenient explanation that hid the underlying insolvency.

The BTC-e laundering channel. Alexander Vinnik's BTC-e exchange (operated from Russia) appears to have been the primary laundering channel for stolen Mt. Gox BTC. Forensic analysis traced movements of Mt. Gox-attributed BTC through BTC-e wallets across multiple years. Vinnik was arrested in Greece in 2017 and the BTC-e platform was seized; Vinnik was eventually extradited to the US in 2022.

The 200,000 BTC 'recovery.' In March 2014, three weeks after the bankruptcy filing, Karpelès announced the discovery of 200,000 BTC in 'old format wallets' that had not been checked. Whether this was a genuine forgotten reserve or a recovery from the same internal mismanagement that caused the problem in the first place is disputed; what's clear is that it reduced the total loss to approximately 650,000 BTC.

Impact

Mt. Gox's collapse was the foundational case study for crypto-exchange counterparty risk. It established 'not your keys, not your coins' as an operational principle, not just a slogan. The collapse triggered a multi-year bear market in Bitcoin (price fell from ~$1,150 pre-collapse to under $200 by early 2015) and severely damaged retail trust in centralised exchanges. It also produced lasting regulatory effects: Japan's Financial Services Agency (FSA) eventually established the world's first formal crypto-exchange licensing regime in 2017, in large part as a direct response to Mt. Gox; the FSA's framework subsequently influenced licensing regimes in other jurisdictions. The case is referenced in nearly every major exchange-failure discussion since.

Operational lessons

  1. 1Self-custody is not paranoia for meaningful holdings. The single most repeated lesson from a decade of crypto failures: long-term holdings belong in self-custody, not on exchanges. Mt. Gox creditors who received their distributions in 2024 received a meaningful real-dollar value due to Bitcoin's appreciation — but they waited 10 years and received the proceeds from approximately 14% of the original holdings.
  2. 2Bankruptcy is multi-year, often a decade. Mt. Gox's recovery proceedings took 10+ years. Even where customer funds are ultimately recovered, the time-value-of-money cost is enormous, and the assets are subject to administrative claims that haircut the recovery further.
  3. 3'Technical issues' as a withdrawal-suspension justification is a red flag. Mt. Gox's 'transaction malleability' explanation in February 2014 was a cover for the underlying insolvency. The pattern recurs (FTX's 'security review,' Celsius's 'maintenance'). Any exchange announcing withdrawal pauses for technical reasons during a stress event should be assumed to be insolvent until proven otherwise.
  4. 4Internal accounting matters as much as cryptography. Mt. Gox's cryptographic infrastructure was probably no worse than its peers'. Its internal accounting was catastrophically bad. The thefts succeeded for years because no one inside the exchange knew the books didn't balance. Modern exchanges' proof-of-reserves attestations exist because of this lesson.
  5. 5Insider involvement was never fully resolved. Mark Karpelès was convicted of falsifying records but acquitted of embezzlement. The question of whether insiders directly participated in the theft, or merely failed to detect and disclose external theft, has never been definitively resolved. The forensic record is sufficient to convict on falsifying records but ambiguous on intent for the underlying losses.

Aftermath

Initial distributions to Mt. Gox creditors began in July 2024 — over 10 years after the bankruptcy filing. Creditors received their entitlement in BTC and BCH (the result of the 2017 Bitcoin Cash hard fork; Mt. Gox creditors are entitled to both). Total distributed assets in the first wave were approximately 142,000 BTC and 143,000 BCH. At 2024 Bitcoin prices, this represented meaningful recovery for individual creditors who held on through the decade-long proceedings. Karpelès' suspended sentence stood; he subsequently lived in Tokyo and engaged sporadically in technology projects. The BTC-e seizure recovered some additional Mt. Gox-attributed BTC. The case remains the canonical example used by every educator, regulator, and risk-manager when discussing exchange-custody risk.

Sources & further reading

We prioritise primary sources. Where a topic moves quickly (regulation, security incidents), we re-check sources on the cadence shown by the page's "Next review" date.

Related on Block Clarity Hub

Self-Custody Masterclass
Beginner Day 6 — Security routine
Security Bootcamp L7 — Exchange security
Spotted an error? Report it on GitHub — our correction policy