Mt. Gox, the world’s largest cryptocurrency exchange, has begun returning Bitcoin to victims of its 2014 hack, sending the price of the currency plunging amid fears of a sell-off.
At its peak 10 years ago, Mt. Gox handled more than 70% of the trading volume of Bitcoin and other cryptocurrencies. But in February 2014, the exchange announced it was shutting down, citing the loss of 750,000 customer Bitcoins and 100,000 company Bitcoins, worth $500 million then and $46.5 billion today.
After nearly a decade of fighting, CoinLab reached a deal in January 2021 with Nobuaki Kobayashi, the trustee of Mt. Gox’s bankruptcy, to return funds to users. He is believed to be holding 142,000 Bitcoins, worth $8 billion. The expected payout date is October 2024, but the process is moving forward.
On the morning of July 5, Mt. Gox transferred 47,228 Bitcoins, worth $2.6 billion, from its cold wallet to a new wallet, kicking off a decade-long wait to repay 20,000 users. But news of the move has sparked a sell-off over the past week. Bitcoin has fallen from $63,000 a coin in early July to $53,000 and is now at $55,000.
“A lot of people who had assets stuck in the Mt. Gox bankruptcy are obviously going to cash out,” John Glover, chief investment officer at crypto lender Ledn, told CNBC. “After what happened, they chose to take their money (after being reimbursed for Bitcoin) and run away from the market.”
“While it is good news for Mt. Gox victims, the inevitable sell-off is understandable, making an already sensitive market like crypto continue to create anxiety,” said James Butterfill, head of research at CoinShares.
JP Morgan analysts have predicted since last month that Mt. Gox’s compensation recipients will soon sell their Bitcoins for profit, but the volatility will end in July. Similarly, Lennix Lai, chief commercial officer of OKX, sees the Mt. Gox-related sell-off as a short-term concern. “Most of Mt. Gox’s creditors are long-time Bitcoin enthusiasts, who are unlikely to sell all their Bitcoins immediately,” he said.
Butterfill said the market also has enough liquidity in case Bitcoin is sold. “The daily Bitcoin trading volume on top exchanges is over $8.7 billion, which means the market is fully capable of absorbing the selling pressure,” he said.
As a result, JPMorgan predicts that Bitcoin will fall sharply in July, but will begin to recover in August.
The aftermath of the hack more than 10 years ago
In late 2006, programmer Jed McCaleb thought about building a website for Magic: The Gathering Online players to trade cards. In January 2017, he bought the domain name mtgox.com, but then moved on to another project because he felt it was “not worth spending time on”.
In 2010, McCaleb read about Bitcoin and realized that the community needed an exchange. In July of that year, he introduced the exchange and used the domain name mtgox.com as a subdomain. In March 2011, he sold the website to a French developer living in Japan, Mark Karpelès.
Karpelès brought Mt. Gox to its peak, processing millions of cryptocurrency transactions at that time. However, a cyberattack took place, targeting the website, which was built with poor security, and gradually “drained” hundreds of thousands of Bitcoins.
According to BitBO, the bankruptcy took place in February 2014, but Mt. Gox had been attacked for several years. On June 13, 2011, the exchange announced that 25,000 Bitcoins from 478 accounts had been stolen. Six days later, the company experienced a second incident when hackers took over a computer from an Mt. Gox auditor and changed the price of Bitcoin to 1 cent. The hacker bought 2,000 Bitcoins at that price and transferred them before being detected. A few minutes later, the price of Bitcoin returned to its original level. The company asserted that it was “in control” by transferring 424,242 Bitcoins from its cold wallet to the exchange’s hot wallet.
In October 2011, Mt. Gox continued to see 20 transactions that were marked “invalid,” sending a total of 2,609 Bitcoins to an unknown wallet, with no private keys.
After the attacks and vulnerabilities were discovered, Mt. Gox tightened its security. However, a later investigation found that Mt. Gox’s private keys were not encrypted after 2011, leading to another 650 Bitcoins being stolen, although it is unclear whether the keys were “obtained through an attack or with the help of an insider.”
Over the next few years, hackers continued to siphon Bitcoins from Mt. Gox without the exchange knowing. By 2013, while the company was enjoying great success, they lost almost all of their Bitcoins. “What is surprising is that they were largely unaware, despite being insolvent for almost two years before the incident became public in 2014,” an expert told BitBO.
Before the attack, many Mt. Gox members criticized poor management and lack of organization, but were not recognized, according to former employees. One anonymous developer said the company did not even use version control software, which is used to prevent colleagues from accidentally overwriting each other’s work if they happen to work on the same file.
According to US court documents released in June 2023, the attackers were identified as Alexander Verner and Alexey Bilyuchenko, along with several others. In 2011, Verner and Bilyuchenko gained access to Mt. Gox’s transaction database and user data. Between then and 2014, they transferred more than 647,000 Bitcoins from Mt. Gox wallets, half to BTC-e, an exchange that was shut down by the FBI in 2017. The rest was transferred to other exchange wallets such as TradeHill and BitInstant.
After Mt. Gox declared bankruptcy due to a long-term hack, Bitcoin plummeted from $1,000 per coin to $600 per coin. By March 2017, when it returned to its old peak, the digital currency had fallen to $200 per coin, causing a “crypto winter” that lasted about three years.