Worked example · 2010-07
Mt. Gox Bitcoin exchange launch — Bitcoin — 2010-07
Summary
Mt. Gox launched in July 2010 as the first major Bitcoin exchange. The domain (mtgox.com) was originally registered by Jed McCaleb in 2007 as a trading platform for Magic: The Gathering cards (the name "Mt. Gox" derived from "Magic: The Gathering Online eXchange"). In July 2010, McCaleb repurposed the platform for Bitcoin trading after reading about Bitcoin on the Slashdot forum and recognizing the need for a centralized marketplace where Bitcoin could be exchanged for fiat currency.
The exchange's launch timing was structurally significant: Bitcoin had existed for approximately 18 months (since the January 2009 genesis block), but there was no centralized exchange infrastructure for Bitcoin-to-fiat trading. The Bitcoin Talk forum (launched November 2009) served as the primary community coordination venue, and early Bitcoin transactions were conducted peer-to-peer via forum posts and IRC channels. Mt. Gox was the first platform to provide a centralized order book, an automated trading engine, and a fiat-currency deposit/withdrawal interface — the three structural primitives that define the cryptocurrency exchange operational model to the present day.
Between July 2010 and early 2014, Mt. Gox grew to handle approximately 70% of all global Bitcoin trading volume, becoming the dominant price-discovery venue for Bitcoin and the primary on-ramp for new Bitcoin purchasers. The exchange's operational infrastructure included:
A centralized wallet architecture — user Bitcoin deposits were held in exchange-controlled wallets, not in user-controlled addresses. This made Mt. Gox the de-facto custodian of all user-deposited Bitcoin on the platform: the exchange held the private keys, and users held account balances in the exchange's internal ledger. This is the structural T11.001 surface: the exchange as third-party signing vendor, where a compromise of the exchange's wallet infrastructure produces customer-side loss.
A hot-wallet / cold-wallet architecture — the exchange maintained "hot wallets" (online, connected to the trading engine, used to process withdrawals) and "cold wallets" (offline, air-gapped, used for long-term storage of the majority of user deposits). The hot-wallet infrastructure was the operational attack surface: an attacker who compromised the exchange's servers could access the hot-wallet private keys and drain the online Bitcoin balances. This is the structural T15.003 surface: the operator's endpoint/infrastructure as the off-chain entry vector for wallet-key exfiltration.
A fiat-currency banking interface — the exchange maintained bank accounts in multiple jurisdictions (Japan, United States, Europe) to process fiat-currency deposits and withdrawals. The fiat-banking interface was the operational bottleneck that ultimately contributed to the exchange's collapse: withdrawal processing delays, banking-partner terminations, and the resulting customer-support crisis progressively degraded the exchange's operational integrity through 2013.
Jed McCaleb sold Mt. Gox to Mark Karpelès in March 2011. Under Karpelès's management, the exchange experienced a series of security incidents of increasing severity:
| When | Event | OAK ref |
|---|---|---|
| 2011-06-19 | Mt. Gox auditor account compromised; BTC price manipulated to $0.01; ~2,000 BTC attempted withdrawal at manipulated price; Mt. Gox halts trading, rolls back transactions | T15.003 (first documented exchange-access-level compromise) |
| 2011-09 | Mt. Gox database leaked; ~60,000 user records (usernames, email addresses, hashed passwords) exposed | T15.003 (database-infrastructure compromise) |
| 2011-2013 (ongoing) | "Transaction malleability" exploited to withdraw BTC from Mt. Gox hot wallets — attackers submitted withdrawal requests, modified the transaction ID (txid) before confirmation, and claimed the withdrawal had failed, prompting Mt. Gox to re-send the BTC; the modified transaction had in fact confirmed, resulting in double-payment from the exchange's wallets. The precise start date and total magnitude of transaction-malleability-based extraction are disputed, but the technique was a known Bitcoin-protocol property from 2011 onward. | T11.001 (exchange signing-infrastructure compromise via transaction-malleability exploit) |
| 2014-02-07 | Mt. Gox halts all Bitcoin withdrawals, citing "transaction malleability" issue | (operational shutdown begins) |
| 2014-02-24 | Mt. Gox website goes offline; all social media accounts deleted; internal "Crisis Strategy Draft" document leaked, revealing |
(exchange collapse) |
| 2014-02-28 | Mt. Gox files for bankruptcy protection in Tokyo District Court; liabilities of |
(bankruptcy filing) |
| 2014-03-20 | Mt. Gox announces discovery of |
(partial asset recovery) |
| 2015-08-01 | Mark Karpelès arrested in Japan on charges of embezzlement and data manipulation | (criminal investigation) |
| 2019-03-15 | Karpelès convicted of data-manipulation charges (sentence: 2.5 years, suspended for 4 years); acquitted of embezzlement | (criminal disposition) |
| 2021-11 | Mt. Gox civil rehabilitation plan approved; creditors to receive ~90% of recoverable assets (~150,000 BTC at 2021 prices) | (creditor resolution) |
| 2024-07 | Mt. Gox trustee begins distributing ~$9B in recovered BTC/BCH to creditors | (ongoing distribution) |
The exchange's collapse in February 2014 was the defining event of the early Bitcoin era: it removed ~6% of the total Bitcoin supply from circulation (at that time), destroyed the dominant price-discovery venue, triggered a multi-year Bitcoin bear market (BTC price fell from ~$850 in February 2014 to ~$200 by January 2015), and established the template for exchange-failure investigation that every subsequent T11.001 + T15.003 case inherits.
What defenders should understand
- Mt. Gox defined the "exchange as attack surface" category. Before Mt. Gox, there was no centralized cryptocurrency exchange infrastructure — Bitcoin was traded peer-to-peer. Mt. Gox created the three structural primitives that define the exchange operational model: a centralized order book, an automated trading engine, and a fiat-currency banking interface. These three primitives created the corresponding attack surfaces: the exchange's wallet infrastructure (T11.001), the exchange's operational infrastructure (T15.003), and the exchange's banking interface (operational risk surface, not directly OAK-tagged).
- The "hot wallet / cold wallet" architecture was Mt. Gox's operational innovation — and its T15.003 attack surface. The hot-wallet infrastructure was the online, internet-connected component that processed customer withdrawals and maintained exchange liquidity. The hot wallet's private keys were stored on exchange servers connected to the internet — making server compromise equivalent to wallet compromise. This is the canonical T15.003 surface: the operator's endpoint/infrastructure as the off-chain entry vector for wallet-key exfiltration. Every subsequent exchange compromise (Bitfinex 2016, NiceHash 2017, Binance 2019, KuCoin 2020, Bybit 2025) inherits this surface.
- Transaction malleability was the T11.001 primitive deployed against Mt. Gox. The Bitcoin protocol's transaction-ID (txid) computation included the transaction's input signatures, which could be modified (malleated) without invalidating the transaction. An attacker who submitted a withdrawal request to Mt. Gox could observe the broadcast transaction, malleate the signature (changing the txid), and rebroadcast the modified transaction. The modified transaction would confirm on-chain with a different txid than the one Mt. Gox's internal systems tracked. The attacker would then claim the withdrawal had failed (because Mt. Gox's systems couldn't find the original txid on-chain) and request a re-send — resulting in a double-payment from the exchange's hot wallet. This technique was a known Bitcoin-protocol property from 2011; Mt. Gox's internal systems did not account for it.
- The Mt. Gox launch is an "infrastructure genesis" event, not a compromise event. At launch in July 2010, Mt. Gox had not yet been compromised. The file exists in OAK to document the launch of the infrastructure that defined the T11.001 + T15.003 attack surface for the subsequent decade. Investigators tracing exchange-compromise events to 2014+ should recognise Mt. Gox as the archetype that established the exchange operational model and the corresponding attack surfaces that every subsequent exchange-compromise event exploits.
Timeline (UTC)
| When | Event | OAK ref |
|---|---|---|
| 2007 | Jed McCaleb registers mtgox.com as a Magic: The Gathering card-trading platform | (pre-Bitcoin origin) |
| 2010-07-17 | McCaleb repurposes Mt. Gox for Bitcoin trading; exchange launches as first centralized BTC/USD marketplace | infrastructure genesis — T11.001 + T15.003 attack surface created |
| 2010–2011 | Mt. Gox grows rapidly; becomes dominant Bitcoin exchange handling majority of global BTC trading volume | (market-dominance phase) |
| 2011-03 | McCaleb sells Mt. Gox to Mark Karpelès (Tibanne Ltd.); Karpelès becomes CEO | (operator transfer) |
| 2011-06-19 | Auditor account compromise (see examples/2011-06-mtgox-auditor-account-compromise.md) |
T15.003 |
| 2011–2013 | Ongoing transaction-malleability exploitation; BTC progressively drained from Mt. Gox hot wallets | T11.001 |
| 2014-02 | Mt. Gox halts withdrawals; website offline; ~850,000 BTC missing revealed; bankruptcy filed | (collapse) |
Public references
- Mt. Gox exchange operational archive — primary-source materials from the exchange's 2010–2014 operational period, including trading-engine architecture, wallet-infrastructure documentation, and incident-response communications.
- Mt. Gox bankruptcy proceedings — Tokyo District Court civil rehabilitation case materials; creditor claims; trustee reports.
- Mark Karpelès criminal proceedings — Tokyo District Court criminal case materials; data-manipulation conviction (March 2019); embezzlement acquittal.
examples/2011-06-mtgox-auditor-account-compromise.md— Mt. Gox auditor account compromise (2011-06-19) — the earliest documented T15.003 incident at Mt. Gox.examples/2014-02-mt-gox.md— Mt. Gox exchange collapse (2014-02) — the terminal T11.001 + T15.003 event; the largest exchange compromise in Bitcoin history.[mtgox2014postmortem]— the leaked "Crisis Strategy Draft" document (February 2014) — primary-source disclosure of the ~744,408 BTC shortfall and the transaction-malleability exploitation vector.[karpeles2019verdict]— Tokyo District Court verdict in the Karpelès criminal case (March 2019).