On this page
is the original crypto catastrophe — the defining early disaster that shaped the industry's approach to custody, exchange security, and the “not your keys, not your coins” ethos. When it fell in 2014, it was handling 70% of all Bitcoin trading. The 850,000 BTC that vanished (roughly 7% of all Bitcoin in existence) would be worth tens of billions of dollars today. The decade-long bankruptcy proceeding is a lesson in what happens when you trust a centralized party with your assets and it fails.
From card game to crypto giant
Mt. Gox began life in 2010 as a platform for trading Magic: The Gathering cards — the name stood for “Magic: The Gathering Online eXchange.” In July 2010, its founder, Jed McCaleb (who would later co-found Ripple and Stellar), converted it into a Bitcoin exchange. At the time, there were almost no places to buy Bitcoin; Mt. Gox filled that gap and quickly became the dominant venue.
In 2011, McCaleb sold Mt. Gox to Mark Karpelès, a French developer living in Japan. Karpelès ran the exchange through his company, Tibanne K.K. Under his ownership, Mt. Gox grew to handle roughly 70% of all global Bitcoin trading volume by 2013. It was, for practical purposes, the center of the Bitcoin world.
But behind the scenes, things were already very wrong. The exchange had been hacked in June 2011 — an attacker used compromised auditor credentials to dump a few thousand BTC and artificially set the price to $0.01. More importantly, forensic analysis later revealed that the exchange had been bleeding Bitcoin for years through a technique that went unnoticed: transaction malleability attacks.
The slow bleed
The key finding of WizSec's investigation was that Mt. Gox had been losing Bitcoin since at least 2011 — not in a single dramatic hack, but through a slow, persistent drain. The mechanism was transaction malleability: an attacker could modify the signature of a withdrawal transaction in a way that changed its transaction ID but not its validity. Mt. Gox's software would see the withdrawal as failed (the original ID didn't confirm) and re-send it — but the attacker had already received the funds via the modified transaction. The exchange was paying out twice and recording only one payment.
This went undetected for years because Mt. Gox's accounting was rudimentary. The exchange didn't properly reconcile its on-chain balances against its internal database of customer balances. Bitcoin was leaving, the internal database said it was still there, and nobody noticed the discrepancy until the hole was enormous.
The root cause of Mt. Gox was not primarily a cryptography failure — it was an accounting failure. Mt. Gox never properly reconciled its on-chain wallet balances with its internal customer-credit database. In traditional finance, this is called “not knowing where the money is.” In crypto, the on-chain ledger is public — anyone could have checked whether Mt. Gox actually held the Bitcoin it claimed. Nobody did, because nobody expected the #1 exchange to be fundamentally insolvent. The lesson: prove reserves cryptographically, don't trust the operator. This is the origin of the Proof-of-Reserves movement.
The collapse
By late 2013, Mt. Gox was already insolvent — it had far less Bitcoin than it owed customers — but this was not yet known. What customers experienced was delayed withdrawals: Bitcoin withdrawals took weeks, then months. Customer support was essentially nonexistent. In February 2014, Mt. Gox halted all Bitcoin withdrawals entirely, citing the transaction malleability bug.
The price of Bitcoin on Mt. Gox diverged sharply from other exchanges — trading at a deep discount — as the market priced in the growing probability that the exchange was insolvent. On February 28, 2014, Karpelès filed for bankruptcy protection in Tokyo and announced that approximately 850,000 BTC were missing.
The 850,000 BTC (worth ~$450 million at the time — tens of billions of dollars today) included 750,000 customer deposits and 100,000 of the exchange's own holdings. It represented roughly 7% of all Bitcoin in existence.
The timeline
Tap any event to expand its story.
Jed McCaleb (later founder of Ripple and Stellar) launches Mt. Gox as a Magic: The Gathering card-trading platform. The name is a contraction of "Magic: The Gathering Online eXchange." He pivots it to Bitcoin trading in July 2010 and sells it to Mark Karpelès in 2011.
In June 2011, a hacker compromises an auditor's credentials, dumps a few thousand BTC, and artificially sets the Bitcoin price to $0.01 on Mt. Gox. The exchange halts trading for days. This is the first warning sign, but the market shrugs it off.
At its peak, Mt. Gox handles approximately 70% of all global Bitcoin trading volume. It is effectively the only game in town. The exchange struggles to keep up — withdrawals are delayed for weeks, customer support is nonexistent, and the codebase is creaking.
In May 2013, the US Department of Homeland Security seizes $5 million from the US bank account of Mt. Gox's subsidiary, Mutuel Sigmut LLC — an account customers reached through the Dwolla payment network — for operating an unlicensed money transmitter. This is the first major regulatory action against a crypto exchange.
In February 2014, Mt. Gox halts all Bitcoin withdrawals, citing a "transaction malleability" bug. Users who have been waiting weeks for withdrawals now cannot get anything. Panic spreads. The price of Bitcoin on Mt. Gox falls far below other exchanges — a sign that the market has lost faith in the exchange's solvency.
Mt. Gox files for bankruptcy protection in Japan. Mark Karpelès announces that approximately 850,000 BTC (roughly $450 million at the time) are missing — 750,000 belonging to customers and 100,000 belonging to the exchange. This is approximately 7% of all Bitcoin in existence at the time.
In March 2014, Karpelès announces that 200,000 BTC have been found in an old-format digital wallet. These are moved through the blockchain (visible to all), eventually traced by researchers at WizSec. The remaining ~650,000 BTC are never recovered.
Japanese police arrest Mark Karpelès in August 2015 on charges of manipulating account balances and embezzlement. He is held in Japan for nearly a year before being released on bail. He maintains that the losses were due to external hacking, not his own actions.
The proceedings drag on for a decade. Nobuaki Kobayashi, the bankruptcy trustee, sells portions of the recovered Bitcoin to fund the estate — ironically at prices far below what Bitcoin later reaches. In June 2018 the case moves from bankruptcy into civil rehabilitation, and under the approved plan creditors are repaid largely in BTC and BCH (a pro-rata share of the recovered coins) rather than the 2014 value of their claims. Repayments finally begin in July 2024 — a decade after the collapse — with the deadline later extended to October 2025.
The recovery — and its bitter irony
In March 2014, Karpelès announced that 200,000 BTC had been “found” in an old-format wallet. These coins, visible on the blockchain, were traced by WizSec researchers. The remaining ~650,000 BTC have never been recovered and are presumed stolen.
The bankruptcy proceedings — led by trustee Nobuaki Kobayashi — became one of the longest and most complex in crypto history. In a bitter irony, Kobayashi sold portions of the recovered Bitcoin in 2017–2018 to fund the estate, at prices ranging from ~$8,000 to ~$12,000. But in June 2018 the case moved from bankruptcy into civil rehabilitation, and under the approved plan creditors are repaid a pro-rata share of the recovered coins — largely in BTC and BCH — rather than the 2014 yen value of their claims. That left most creditors recovering far more than the 2014 value of their deposits, though less than their full original Bitcoin.
After years of legal battles, repayments finally began in July 2024 — a full decade after the collapse — with the repayment deadline later extended to October 2025. The repayments were made largely in BTC and BCH (a share of the recovered coins), with yen for the portion of the estate that was sold. Creditors recovered a fraction of their original Bitcoin, and a decade of lost opportunity cost is not compensable.
The legacy
Mt. Gox shaped the crypto industry in lasting ways:
- “Not your keys, not your coins.” The phrase became the defining principle of crypto self-custody after Mt. Gox. If you leave your Bitcoin on an exchange, you are an unsecured creditor of that exchange — not the owner of Bitcoin. The Wallets module covers this in depth.
- Proof of Reserves. The idea that exchanges should cryptographically prove they hold the assets they claim — without revealing individual balances — gained momentum as a direct response to Mt. Gox's accounting failure.
- Exchange diversification. After Mt. Gox, no single exchange has ever dominated to the same degree. The market learned (the hard way) that concentration risk on a single venue is dangerous.
- Regulatory attention. The Mt. Gox collapse was one of the events that pushed Japan to become one of the first countries to create a formal crypto exchange licensing framework (2017).
Mt. Gox was the first major exchange collapse, but it was not the last. The pattern — a centralized exchange mismanages or misappropriates customer funds, and customers discover they are unsecured creditors only after it's too late — has repeated with in 2022 and others. The technology has improved; the human incentive to cut corners with other people's money has not. Self-custody eliminates this risk entirely. For the modern version of this story, see the FTX deep dive.
Key takeaways
- Mt. Gox handled ~70% of all Bitcoin trading before collapsing in February 2014 with ~850,000 BTC missing (7% of all Bitcoin at the time). 200,000 BTC were later found; ~650,000 BTC were never recovered.
- The root cause was not a single hack but a years-long slow drain via transaction malleability, combined with a fundamental accounting failure: the exchange never reconciled on-chain balances against its internal database.
- The proceedings took a decade. After the case moved to civil rehabilitation in June 2018, creditors were repaid largely in BTC and BCH — a share of the recovered coins that far exceeded the 2014 value of their claims, though not their full original Bitcoin. Repayments began in July 2024.
- Mt. Gox gave rise to the “not your keys, not your coins” ethos, the Proof-of-Reserves movement, and the understanding that leaving assets on a centralized exchange makes you an unsecured creditor.
- The pattern — centralized exchange collapses, customers discover they're unsecured creditors — has repeated (FTX, 2022). The lesson is the same: self-custody eliminates counterparty risk.