MtGox and the labyrinth of speculation

Today has brought the moment majority of the Bitcoin community having been expecting for a long time now. We wrote an article recently about MtGox freezing withdrawals and taking their site offline but today they have publicly filed for bankruptcy and admitted they had lost 850,000 Bitcoins and around $65M USD.

The French CEO of MtGox, Mark Karpeles, said in the announcement in front of Japanese media, "First of all, I'm very sorry. The Bitcoin industry is healthy and it is growing. It will continue, and reducing the impact is the most important point."

Mark blamed the Bitcoin malleability bug for the majority of the losses but the Bitcoin community definitely have a different opinion of the situation.

In the past few days, numerous people have decided to look further into Gox's assets in their own time to see exactly what had gone to cause the collapse in the exchange. The results of the research have left many people confused and left with no choice but to question the exchange.

An IRC log posted on Pastebin on June 23rd 2011 there is an insight to some of the 'missing coins'. Here is an important snippet from the logs;

  1. <go1dfish> MagicalTux: 432109.87654321 is that pattern random, or was it chosen deliberately?
  2. <go1dfish> by patern I mean the fact that it looks like a countdown
  3. <sharkasgo> probably deliberate so it would be easy to search for
  4. <MagicalTux> go1dfish: it's deliberate
  5. <MagicalTux> want me to do it again? :)
  6. <go1dfish> MagicalTux: yes, if you could send like a tiny amount to an address someone throws out
  7. <go1dfish> that would do a huge amount to restore confidence
  8. <MagicalTux> I broke out the 432109.87654321 already
  9. <MagicalTux> but I'll make a new one
  10. <UberCookies> I wonder if I've reclaimed my account correctly...
  11. <xelister> do .424242
  12. <MagicalTux> xelister: 424242.42424242 ?
  13. <xelister> yeap
  14. <go1dfish> just need to see a transaction happen from an account with a huge balance with an amount listed here to an address listed here
  15. <MagicalTux> connecting the offline storage and decrypting on a firewalled system~
  16. <go1dfish> 1AbTRVrRYGri1sZvqHBadnXaCHkuXJtV5N
  17. <MagicalTux> I'll make the transaction and push it manually
  18. <notallhere> this would completely restore a lot of peoples faith
  19. <go1dfish> MagicalTux: post an address and I'll send you an amount
  20. <Ooofo> MagicalTux, to get the "free month of trading" thing, will that be automatically done based on rolled back trades or do we have to apply somehow?
  21. <MagicalTux> Ooofo: it'll be automatic
  22. <Ooofo> awesome
  23. <MagicalTux> I got all the data of all the affected users here
  24. <MagicalTux> go1dfish: no, not practical
  25. <go1dfish> ok
  26. <MagicalTux> go1dfish: I'll send 424242.42424242 bitcoins from a bunch of 50kBTC addresses (and maybe on 42kBTC) to one
  27. <MagicalTux> well, two actually
  28. <MagicalTux> one will get the 424k, the other one will get the change
  29. <go1dfish> ok, yeah all transactions get split that way as I understand it
  30. <MagicalTux> ready guys? Don't come after me claiming we have no coins after that
  31. <MagicalTux> hopefully I'll be able to work without getting too much disturbed after that~
  32. <go1dfish> yeah, ready
  33. <nanotube> MagicalTux: wasn't your last tx 432K btc? lost 8k?
  34. <geist_> no
  35. <geist_> thats just the amount someone suggested
  36. <geist_> (the 424242)
  37. <nanotube> ah
  38. <MagicalTux> 42 is the answer
  39. <go1dfish> to everything
  40. <sixEch0> 42 is my password!
  41. <noagendamarket> lol
  42. <nanotube> hehe ic
  43. <go1dfish> 42 is the solution to every block to
  44. <mabus> wait what's going on, is he proving he has our bitcoins still?
  45. <go1dfish> shit I just ruined the economy
  46. <mabus> what does this help
  47. <geist_> theres a lot of people crying wolf saying gox doesnt have their btc anymore
  48. <wumpus> don't send them to the bitcoin eater please :)
  49. <go1dfish> mabus: tux is shuffling large numbers of bitcoins to show they are still under his control
  50. <MagicalTux> anyway, going to send to 1eHhgW6vquBY... the 424242.42424242 btc

We can see from the above log the community were questioning Mark about the amount of Gox claim to have held in 2011 and wanted proof he owned a large amount. We can see that he agreed to send 424242.42424242 to an address beginning with 1eHhgW6vquBY. Funny enough, we've located said transaction and confirmed it happened. It can be seen in the following.

The above transaction shows that Gox, at least at one point in time, had a large sum of Bitcoins.

Digging further into the transactions we can see that a few weeks later the large amount of Bitcoins are broken into a smaller amount and placed into two address as seen below;

We can only assume as this point that this address also belongs to Gox.

A short time after this, a transaction occurred which broke the large amount of Bitcoins into wallets, each containing 50,000. We don't know the exact reasoning for this but we can presume they were possibly being moved into cold storage separately.

2 months after this, a transaction occurs from within the addresses that still are connected to Gox which transfer batches of 50,000 into a larger sum of 500,000 apart from 1 address which still contained 50,000 which can be seen below;

If we follow the 500,000 Bitcoin wallet, we can see that they make a large transaction of nearly all of the coins are made and sent to a wallet publicly belonging to Gox on the Blockchain as seen below. This can only prove our theory that Gox had been in control of the coins the whole time.

The 50,000 address we mentioned earlier then split the coins into a batch of 40,000 and a batch of 10,000. This wallet also was under the control of Gox and the 40,000 Bitcoin address still remains there, untouched, since 2011.

When the wallets had combined to sent the 500,000 + 50,000, there was a wallet which wasn't included and this wallet, to this day, still has 50,000 Bitcoins in the wallet which are unspent.

We can see that all of the mentioned addresses clearly belong to Gox and after slightly digging through them we can see they have 90,000 Bitcoins which have been there since 2011. I'm sure if we dug further and investigated more we would be able to find much more Bitcoins.

This raises the question, who is lying?

In the Gox leaked crisis plan, it stated they had 2,000 Bitcoins to their name. This means either the document was false, Mark or an employee had lied in the document in an attempt to hide the funds or the firm have lost the private keys for the wallets rendering them nothing more than eye candy.

We are not claiming they didn't lose some coins legitimately to the malleability bug but there is no way that 500,000 coins could have been stolen. Even the planets worst auditor wouldn't have missed such a large amount of Bitcoins disappearing from the companies reserve.

Could this be an attempt to walk away with stashed Bitcoins or has the company been running on lies after finding out their wallets were missing funds and/or they lost the private keys.


  1. I made some 0.001 "tracer" deposits to Gox as they were shutting down...

    Looking at the outputs, I'm guessing that this shows 5 BTC in Gox cold storage since withdrawals were already suspended.

  2. regarding:
    If we follow the 500,000 Bitcoin wallet, we can see that they make a large transaction of nearly all of the coins are made and sent to a wallet publicly belonging to Gox on the Blockchain as seen below. This can only prove our theory that Gox had been in control of the coins the whole time.

    If you look at the Gox address:
    You never see that transaction actually hit the wallet.

    Should be here:

    You see a break in transactions between 2011-10-14 10:17:20 and 2012-02-25 14:54:30

    Approx. 4 mos of missing transactions?

    What am I missing here?

    1. Sorting on is broken

  3. It's all rigged ^^