REPORTER: The CEO of Mt. Gox has released a statement for the first time since the Bitcoin
exchange was shut down. This, amid speculation that the CEO was in hiding following reports that
an estimated 744,000 Bitcoins, worth about 350 million dollars, was stolen. Japanese authorities
are currently said to be investigating the matter. JACK (INTRO): [INTRO MUSIC ] This is Darknet
Diaries, true stories from the dark side of the internet. I’m Jack Rhysider. [INTRO MUSIC ENDS]
JACK: What if there was a money system that wasn’t tied to any specific country? What if
that money system was both anonymous where you can’t tell who owns the money, and transparent,
where anyone can see every transaction? What if that money system was completely digital
where there wasn’t a need to print bill or coins? There is such a money system;
it’s called Bitcoin. Bitcoin is a decentralized electronic currency. Instead of there being a big
data center that handles all the transactions, in Bitcoin world the transactions are done by
crowdsourcing. Anyone can join in on processing Bitcoin transactions. But why should they?
When people use their computers to help process Bitcoin transactions,
they get a small amount of Bitcoin in exchange. There are a couple of other neat features of
Bitcoin. It’s not tied to any particular country, it’s anonymous, and all transactions and Bitcoin
are public information. When someone gives Bitcoin to another person, anyone can see
that that money was moved. You might find all this confusing but just know this; Bitcoin
is digital money and you can buy it in almost the same way you can buy any foreign currency;
through an exchange. You give the Bitcoin exchange your dollars and they send you the digital money.
You can keep your digital money in the exchange itself or move it to your own Bitcoin wallet
which can be stored on your computer, or phone, or somewhere else. Bitcoin has been around for
less than ten years. It first started in 2008 but for the first few years there were no exchanges.
In 2010 a web programmer named Jed McCaleb took an interest in Bitcoin and he had an old domain
lying around called mtgox.com which initially stood for Magic the Gathering Online Exchange
but that project only lasted a few months before he abandoned it so he reused that domain and used
it to start the first Bitcoin exchange called Mt. Gox in July 2010. Being first to market of
an emerging technology usually means you’re going to be the leader of the market. That
was certainly the case for Mt. Gox. For the entire life of Mt. Gox, it was the dominant
Bitcoin exchange for the world. Even when there were multiple other exchanges, Mt. Gox was still
processing 70 percent of all Bitcoin. They were processing over 100,000 Bitcoins a day,
which would well exceed 15 million US dollars. You could go to the Mt. Gox website and buy Bitcoin
with US dollars, Japanese yen, British pounds, Russian rubles, and several other currencies.
You could also do the opposite; trade your Bitcoin for any of those currencies and they’ll deposit it
into your bank account. Mt. Gox was the go-to place if you wanted to buy or sell Bitcoin.
But all that came to a screeching halt in 2014. Suddenly, without warning, Mt. Gox went offline
and shut down. Mt. Gox contained 750,000 Bitcoins when they shut down. That’s seven percent of the
Bitcoins in the world, which was worth over 450 million US dollars. A statement from Mt.
Gox initially said the Bitcoins were stolen. So what happened? A series of unfortunate
events. [MUSIC] The technology behind Bitcoin is fairly complicated. Investigators, police,
government agencies, they just don’t have the resources to really investigate and figure out
what happened to the Bitcoins at Mt. Gox. In fact, a lot of it is over my head, too.
KIM: Hello?
JACK: So I called someone up.
KIM: Hi Jack, how are you doing?
JACK: Who knows a thing or two about Bitcoin.
KIM: My name is Kim Nilsson. I’m actually just a general software consultant. I work
with software development mostly, but I also do blockchain analysis or as I
sometimes call it blockchain archaeology since I mostly look into historical stuff.
JACK: The blockchain is the public record that stores all Bitcoin transactions. There are over
[00:05:00] 300,000 transactions a day and each one of these is stored in a way that anyone can view
them all. Bitcoins are stored in virtual wallets. We can see how much Bitcoin moves around from one
wallet to another but we can’t determine who that wallet belongs to. That part is anonymous.
KIM: I was pretty much a Mt. Gox customer, yes. I was just using them for trading and whatnot.
I wasn’t really actively observing them while they were up or anything,
so I was kind of taken off-guard when Mt. Gox just went down. I didn’t lose
an insane amount of money but I didn’t take it particularly well. I felt like someone
needs to investigate this and I wasn’t really prepared to trust that normal law enforcement,
the normal usual actors would investigate it properly considering a) what a cutting edge
technical field it is and b) would they even get the necessary data and whatnot?
I kept watching the situation going forward from there with great interest. There started
to be leaks coming out with some of the internal Mt. Gox data. Suddenly well,
actually maybe someone else can investigate this from the outside. That’s sort of where this all
got started. I joined forces a little bit with some other guys and cooperated when necessary
and we tried to get a hold of as much data as we could to try to figure it out. After that
it’s basically just been me plowing through that and doing technical analysis on it ever since.
JACK: For the last three years Kim has been studying the blockchain and trying
to personally piece together what happened to Mt. Gox. He’s trying to count how much money went in,
how much money went out, and reconcile these numbers. This is no easy task. The
data containing all these transactions is almost 40 gigabytes and there were hundreds
of millions of records. He was trying to go through all of them to try to make sense of
what happened to Mt. Gox. He spent a long time crunching this data and found brilliant ways
of searching it faster. He would also ask the CEO of Mt. Gox directly for additional
information. The CEO would sometimes comply. It also helped that they both lived in Japan.
KIM: As you say, one of the things that makes it quite hard to get an overview
of what actually happened in Mt. Gox is that there really wasn’t any one thing,
it was a lot of different things. Some of them are connected,
some of them aren’t. It’s hard to get a single satisfying answer to what actually happened.
JACK: Let’s start from the beginning and try to find where Mt. Gox went wrong.
KIM: [MUSIC] Mt. Gox was founded, or reworked, as a Bitcoin exchange in 2010.
JACK: Which was likely ran by a single person at the time,
Jed McCaleb. He was a web developer and personally created the site from scratch.
KIM: In January of 2011 there was two exploits
related to Mt. Gox integration of Liberty Reserve withdrawals.
JACK: Liberty Reserve was a company Mt. Gox used to transfer money from
one person to another. It was a service tied to their back end which allowed money to be
moved around but Jed made some mistakes when adding the service to his site.
KIM: A user would just be able to inject XML to override parameters in the API request
sent to Liberty Reserve to get more money than they actually withdrew from Mt. Gox.
JACK: So hackers were withdrawing more than they should be allowed to withdraw
by exploiting this poorly implemented code. But that wasn’t the only issue
Jed had with Liberty Reserve. Users type in how much money they want to withdraw, but…
KIM: The code forgot to check for negative inputs.
JACK: This had screwy results, allowing users to withdraw money they didn’t have. Jed found
these bugs and fixed them but it wasn’t until he had already lost $50,000. Around that time,
Jed McCaleb and Mark Karpelès started talking. Jed was realizing the site required more time
than he could put into it. Then Mark showed an interest in taking over Mt. Gox from Jed. Mark
was a web programmer from France but had recently moved to Tokyo, Japan where Mt. Gox was located.
KIM: Jed basically almost gave it away to Mark Karpelès in that very favorable price and sold it
for almost no upfront money and just getting a cut of the revenue for the next six months, I think.
JACK: But just before the transfer of ownership to Mark, something terrible happened to Mt. Gox.
Someone had broken into the Mt. Gox servers and stole the hot wallet file. The hot wallet
is a Bitcoin wallet Mt. Gox used to conduct daily operational trades. This
differs from a cold wallet, which was not stored on the Mt. Gox servers but
in another location in a much safer place. The thief took the hot wallet
and then transferred all the Bitcoins that were in it to their own wallet.
KIM: That was about 80,000 Bitcoins that disappeared and are actually
still sitting untouched on the blockchain to this day. It’s quite possible they’ve
been [00:10:00] accidentally destroyed or something. Since these 80,000 Bitcoins have
been stolen there was of course, at this point, already a shortage. Mt. Gox was technically
already insolvent as soon as Mark Karpelès took it over. I don’t think Mt. Gox was ever,
in fact, solvent for a single moment for as long as it existed under Mark Karpelès.
JACK: That is, if all the Mt. Gox users were to try to take
all their Bitcoins out of the exchange, there wouldn’t be enough for everyone.
KIM: Already by the time Mt. Gox was sold a few months later, there was a lot
of money missing. So off to a bit of a bad start under his management, you could say.
JACK: Mark Karpelès is now running Mt. Gox from Tokyo, Japan. All ownership is
now transferred to him and a few months go by under his management. Mark was in
the process of figuring out where the Mt. Gox Bitcoins should be kept. He had some
in the Mt. Gox servers in the form of a hot wallet and he had some in a secure off-line
location which is a cold wallet, but he also had some on his personal computer.
KIM: During this time it appears that someone was able to get into Mark’s own computer which at this
particular point in time appears to have been quite unsecured. It looks like they got it off
of his personal machine from home. At the time he was unfortunately keeping 300,000 Bitcoins
from Mt. Gox on his own unsecured machine, and a thief was just poking around, got lucky,
and found it and ran away with it. This is a huge number of Bitcoins lost obviously,
but it never got any mainstream attention because actually the thief, as it turned out, got nervous
it seemed and offered to give all the Bitcoins back in exchange for a small keeper’s fee.
JACK: The thief kept 3,000 Bitcoins and gave the remaining 297,000 back to Mark.
KIM: Probably, if I were to venture a guess, they offered to give the coins back because
they hadn’t been particularly careful. I don’t think it was some master hacker. It
was probably just someone poking around, like I said. If I had been in their shoes
I probably would have been astonished that it even worked in the first place. Presumably the
deal at the time was that they gave the coins back in exchange for not being investigated.
JACK: Another month goes by. It’s now June 2011. Mark had
only been running Mt. Gox for about three months.
KIM: At some point someone again got into Mt. Gox’s system. They were probably able to take
a small database dump of the user’s table that contained accounts and their password hashes
and everything. Whoever stole this small database dump were able to also brute-force a fair amount
of the passwords including the password to Jed’s own admin account. Part of having an
admin account at Mt. Gox meant you had access to a small, separate page where you can view
admin tasks like manipulate account balances and things like that. Whoever got into this
made good use of this little feature and started adding crazy amounts of Bitcoins to new accounts.
JACK: The hacker was creating Bitcoin out of thin air and selling them as fast as they could.
Bitcoin was worth around 17 dollars at the time. This hacker sold so many Bitcoins it
drove the price all the way down to one cent each. Some people bought thousands of Bitcoins
at that price. The market had gone haywire and hit rock bottom. Then the thief bought back
the cheap Bitcoin and tried to move the Bitcoin to another address, but Mark Karpelès saw this
crash happening and shut the servers down. He knew something was very wrong and investigated.
He even had help from others to investigate the situation. Mt. Gox remained offline for
days. They eventually found how the hacker got in and crashed the market, so Mark rolled back
the system to undo all trades during the time of the crash. Mt. Gox came back online with the
price restored back to 17 dollars per Bitcoin but the hacker wasn’t completely empty-handed.
KIM: They were also able to get some actual Bitcoins out by inflating balances, trading
them for a bit, and just trying to withdraw. They got about two thousand Bitcoins out that way.
JACK: It’s two thousand Bitcoins that Mt. Gox had to absorb since they were
actually transferred out of Mt. Gox. A couple more months go by and Mark
is looking to expand Mt. Gox to be able to do business in Europe.
KIM: In late summer 2011 there was this other exchange in Poland called Bitomat
that accidentally destroyed their own Bitcoin holdings. I think they had their wallet in
a virtual machine that accidentally wiped it or something like that. That destroyed
17,000 Bitcoins. At this point Mt. Gox was sort of looking to [00:15:00]expand and have
local licenses and whatnot to operate in local markets. They were trying to get a
foothold in Europe. Mark looked at this as a chance to get into Europe by acquiring
Bitomat and whatever company registrations they had in exchange for covering this debt,
basically. Mt. Gox absorbed all of Bitomat including the 17,000 Bitcoin in customer holdings.
JACK: At this point Mark had only been running Mt. Gox for about five months and is already missing
$50,000 in cash and a massive 100,000 Bitcoin. While Mark’s skillset was mostly in programming,
he believed Mt. Gox could be turned around and become a very profitable
company. He had every intention on making it a success. He was just in a little over
his head. Not another month goes by and there is another breach.
KIM: Yep, another incident where someone seems to have gotten into the system. They have access
to the database. Recall that the June hack, as well, involved getting information out of
the database. This time around though, there definitely seems to be that the attacker has
right access to the database as well, that they can make changes directly to it and they make –
they alter account balances, they’re able to wipe accounts. They tried to wipe their
tracks as well in this way. Because of that, this incident is a bit harder to track because
all of the evidence seems to have been wiped. I’ve reconstructed some of it by basically
sketching out the gaps where there should have been logs but there aren’t any, or there are
orphan records in the database that suggest that something has been deleted and whatnot. Probably
by the best estimates, something a bit short of 80,000 Bitcoins was taken out of Mt. Gox.
JACK: Mark did not detect this breach until after the Bitcoins were already transferred out of Mt.
Gox, so he wasn’t able to stop this theft from happening. Now Gox is now missing almost 200,000
Bitcoins. The very next month another breach occurs and this one, the biggest one of all.
KIM: [MUSIC] The hot wallet, wallet.dat got stolen by someone with access to the system.
JACK: Once again, the hacker broke into the Mt. Gox server and stole the Bitcoin wallet from Mt.
Gox. The thief quickly moved the Bitcoin into their own wallet but because they had control
of the main hot wallet from Mt. Gox, any new deposits into that wallet, the thief would also
be able to take those funds, too. For the longest time Mt. Gox didn’t detect any of this activity.
KIM: This theft went on until at least a good chunk into 2013. That’s almost a full two years.
JACK: By the time it was finally detected and stopped,
the thief had been able to siphon 650,000 Bitcoins from Mt. Gox.
KIM: This is the big theft that most people will be thinking of
when they talk about the Mt. Gox missing Bitcoins.
JACK: You might be wondering why didn’t Mark encrypt the wallet? Well ironically,
the feature to encrypt Bitcoin wallets was released a few weeks after the theft
took place. There simply wasn’t a technology out there to encrypt Bitcoin wallets at the
time. You might also wonder why Mt. Gox was target for so many attacks.
KIM: Bitcoin is basically incentivized hacking in that now that you have things
like crypto-currency you can actually steal actual money just by hacking computers whereas
previously you could just acquire the means of stealing the money and whatnot. You can
get data in holding them for ransom and whatnot but with Bitcoin and other crypto-currency you
can actually steal the actual money from digital systems. That increases the risk by a magnitude,
easily, in that it now is a lot more lucrative for hackers to attack your systems. Mt. Gox had
the – it was a double-edge sword in that it pioneered a lot of the markets [00:20:00] but
also since it was the first, it’s not like this was some big established company that spent
millions developing secure software or anything. It was just an amateur code base that they were
then trying to keep patched and somehow handle the load over the years. It was never a professional
exchange in the sense that people who deposited money probably thought or wanted it to be.
JACK: Even though by this time Mt. Gox had lost over 800,000 Bitcoins, the problems didn’t stop
there. Another error in the code base of Mt. Gox had a problem processing transactions.
KIM: This showed up in the Mt. Gox system as a deposit to user accounts even though
there was no new Bitcoins coming in. It was misidentifying those transactions as putting
new Bitcoins into user accounts. It was a bit under fifty accounts;
they got free Bitcoins for about 45,000 Bitcoins in total.
JACK: There went another 45,000 Bitcoins. During that month of October 2011, Mark Karpelès deployed
a new wallet system into Mt. Gox that he had programmed himself in an attempt to have a
more secure service but near the end of 2011 his new wallet system had a programming error.
KIM: This is an instance where he actually had a bug in his code. That meant that a
number of withdrawals actually sent Bitcoins to unspendable addresses,
which is the same as destroying Bitcoins. That lost about 2,500 Bitcoins that became
destroyed because of this. The irony is that this is basically the only real
instance of Mark’s replacement wallet actually losing any significant funds.
JACK: Mt. Gox didn’t have any more thefts or break-ins since the new wallet software was
added. It seems like his improved security was working. But Mark knew he was missing so many
Bitcoins and Mt. Gox was insolvent. He tried to keep all these breaches and thefts under wraps
and hidden from the public. He didn’t want to ruin the reputation of Mt. Gox being the leader
of Bitcoin exchanges so he tried to keep these breaches secret. Things went okay for Mark and
Mt. Gox in 2012. No significant breaches occurred, no big programming errors that resulted in a loss
of Bitcoin, and Mt. Gox continued to dominate the market as the largest Bitcoin exchange.
It appeared that Mark had finally gotten things under control and was slowly recouping his losses.
By mid 2013 Mt. Gox was handling 70 percent of the world’s Bitcoin trades which was around
150,000 Bitcoins a day. Even though it was the leader of Bitcoin exchanges there weren’t that
many employees working for Mt. Gox. Mark did a lot of the programming himself but he did have a few
other developers helping out. It’s not clear whether Mark thought he could just handle it
himself, or he had a hard time trusting others, or maybe he didn’t have the money to hire staff.
[MUSIC] In 2013 Mt. Gox wanted to expand into the US so it agreed to use a company
called CoinLab to handle all North American transactions. Mt. Gox gave
them five million dollars to get started with, but for some reason this deal went
bad and CoinLab filed a lawsuit against Mt. Gox because of a breach of contract. CoinLab
was seeking 75 million dollars and they kept the five million dollars that Mt. Gox gave them. I
believe this lawsuit is still going on today. Later in the summer of 2013 the US Department
of Homeland Security issued a warrant to seize money from Mt. Gox. They had been in
violation of acting as an unregistered money transmitter in the US. In total, DHS seized
five million dollars from Mt. Gox. It was also discovered that Mark was running a trading bot.
KIM: [MUSIC ] I don’t know who had the original idea. There was an e-mail leaked where Mark and
Jed is discussing it and Jed is, amongst other things, suggesting that maybe you can
make trades on your own exchange to shift this liability back and forth between Bitcoins and
fiat money as a way to recover the funds, if you can basically trade the losses back. Of course,
require you to be a trader that can make reliable profits and Mark doesn’t seem to have been a
trader that was able to make profits. If anything he seems to have bought high and sold low.
JACK: This trading bot he was running was called the Willy Bot and there’s a
paper that explains it in detail. At the time the paper came out it was just speculation,
though. But the speculation proved to be spot-on.
KIM: The way Mark had implanted this internal trading mechanism,
it actually kept all the logs so it’s possible to get quite accurate information
of what work was done or not. He didn’t seem to wipe any logs or anything like that.
JACK: By analyzing the logs and adding up the trades, this bot resulted in
Mark [00:25:00] losing an addition 50 million dollars and 22,000 Bitcoins. In February 2014
Mt. Gox suddenly, without warning, halted all withdrawals from its site. Mark stated they
were addressing some security concerns but a few weeks later Mt. Gox, the largest Bitcoin exchange
on the market, shut down entirely. [MUSIC] The website went offline and simply returned a blank
page. Protests began outside the Tokyo office. Thousands of customers were furious. Mt. Gox had
closed his doors, seemingly holding onto 850,000 Bitcoins but in reality the Mt. Gox coffers
were entirely empty. At the end of February Mt. Gox had filed for bankruptcy in Tokyo,
stating they had lost 850,000 Bitcoins which was worth 470 million dollars. Nobody believed
that Mark had lost this many Bitcoins. That’s seven percent of all the Bitcoins in the world.
People just couldn’t grasp how such a large amount of Bitcoins could become
lost. But as you heard it was lost, just not all at once. The next month,
when looking through some of the old Mt. Gox systems that were in use in 2011,
Mark Karpelès found a wallet in the system that still had 200,000 Bitcoins. This brought
the total losses down to 650,000 Bitcoins. In August 2013, Tokyo police arrested Mark
Karpelès. Not for losing the 650,000 Bitcoins but on charges for embezzlement and fraud.
Japanese prosecutors accused him of falsely adding Bitcoins into the accounts of investors
and then moving that to his own wallet. He has continued to plead innocent to these charges.
As far as the thieves go who stole the money from Mt. Gox, only one person has been caught
and arrested. His name is Alex Vinnik and is a Russian national and was arrested in
Greece. He was arrested for money laundering but evidence shows that he had some of the
Bitcoins that were stolen from Mt. Gox. However, just because he had them doesn’t
mean he stole them. He was just accused of laundering, not of stealing the Bitcoin. The
year after his arrest, Mark Karpelès was released on bail and is currently residing in Tokyo. He’s
still undergoing the legal process of his arrest in the Mt. Gox bankruptcy.
Those 200,000 Bitcoins he found have sat untouched since he found them. The bankruptcy case restricts
him from touching them but since 2014 when Mt. Gox filed for bankruptcy, the price of Bitcoin
has skyrocketed. At the time of this recording it’s now worth over $10,000 per Bitcoin. Mt.
Gox owes their creditors 450 million dollars which is what the Japanese courts have locked
in as what he owes. But his 200,000 Bitcoins are now worth two billion dollars. If he were
to pay off all his creditors today, he may then get to walk away with over one billion dollars.
KIM: For sure, the industry and the community has learned a lot since Mt. Gox. Like I said,
most of the reason for Mt. Gox being so unprepared to fill its own shoes, so to speak, was because it
was the first of its kind. There was no real best practices back in 2011 or anything like
that and as anyone has been in any initially successful start-up can tell you, it can be
really hard to keep up with actually investing the time needed to keep your technology up to date.
JACK: One big thing we’ve learned from Mt. Gox is that it’s not a good idea to leave your Bitcoin
on the exchange unless you’re actually trading it. For long-term storage it’s best to keep a Bitcoin
wallet on your own computer that you control. This way it can’t be stolen from an exchange but you
still need to be careful, protect your computer from thieves, though. When determining if an
exchange is reliable, check to see if it complies with audits. For Bitcoin exchanges to operate in
the US they must adhere to strict audits but some exchanges even take it a step further and agree
to even more strict audits. It’s also good to use an exchange that has a good reputation and
not something that’s just popped up yesterday. A lot of lessons can be learned from Mt. Gox.
KIM: Yeah, it’s quite a wild ride.
JACK: And it will be interesting to see what happens next,
not just to Bitcoin but also to Mt. Gox and Mark Karpelès.
JACK (OUTRO): [OUTRO MUSIC] You’ve been listening to Darknet Diaries. For show notes and links,
check out darknetdiaries.com. Music is provided by Podington Bear.