OAK — OnChain Attack Knowledge

Worked example · 2010-07

Mt. Gox Bitcoin exchange launch — Bitcoin — 2010-07

Loss
n/a (genesis event — infrastructure launch, not a compromise event). The Mt. Gox exchange would later become the site of the largest exchange compromise in Bitcoin history: approximately 850,000 BTC (roughly $473M at the time, per [mtgoxwiki]) lost or stolen over a multi-year period culminating in the exchange's February 2014 collapse.
OAK Techniques observed
none — infrastructure-genesis event, not a compromise event. The Mt. Gox operational surface that would later be exploited is the canonical attack surface for T11.001 (Third-Party Signing Vendor Compromise — the exchange as wallet-custodian for user deposits) and T15.003 (Operator Endpoint/Infrastructure Compromise — the exchange's operational infrastructure as the off-chain entry vector for wallet-key exfiltration). The Mt. Gox launch is the structural ancestor of these two Technique surfaces: the exchange-as-custodian pattern that T11.001 documents and the operator-infrastructure-as-attack-vector pattern that T15.003 documents both trace their lineage to the Mt. Gox operational model established at launch in July 2010.
Attribution
unattributed n/a (infrastructure launch). Mt. Gox was founded by Jed McCaleb (who had originally created the domain as a trading platform for Magic: The Gathering cards — "Magic: The Gathering Online eXchange" → "Mt. Gox") and was repurposed for Bitcoin trading in July 2010 (launch date 2010-07-18 per [mtgoxwiki]). McCaleb sold the exchange to Mark Karpelès in March 2011. Karpelès was subsequently arrested in Japan in August 2015 on charges of embezzlement and data manipulation related to the exchange's collapse; he was convicted in March 2019 of falsifying data (30-month sentence, suspended for four years) [mtgoxwiki][karpelesbbg].
Key teaching point
The Mt. Gox launch in July 2010 establishes the canonical "exchange as attack surface" pattern that OAK-T11.001 and OAK-T15.003 document as two of the most consequential Technique surfaces in the cryptocurrency incident record. Investigators tracing exchange-compromise events from 2014 forward should understand Mt. Gox as the archetype that defined the category: the first exchange to achieve systemic market dominance (~70% of all BTC trading volume at its peak), the first exchange whose operational infrastructure was compromised at scale, and the incident whose collapse (2014-02) established the template for exchange-failure investigation that every subsequent T11.001 + T15.003 case inherits. Mt. Gox is not itself a T11.001 or T15.003 incident at launch — it is the infrastructure whose operational surface defined the attack class.
Corrected 2026-10-11
Moved the user-database leak from September to June 2011 (it followed the mid-June thefts), the claim of malleability exploitation from 2011, and several unsourced dollar figures; launch date is 2010-07-18 and the 2019 verdict was falsifying data (30 months suspended).

Summary

Mt. Gox launched in July 2010 as the first major Bitcoin exchange. The domain (mtgox.com) was originally registered by Jed McCaleb in 2007 as a trading platform for Magic: The Gathering cards (the name "Mt. Gox" derived from "Magic: The Gathering Online eXchange"). In July 2010, McCaleb repurposed the platform for Bitcoin trading after reading about Bitcoin on the Slashdot forum and recognizing the need for a centralized marketplace where Bitcoin could be exchanged for fiat currency.

The exchange's launch timing was structurally significant: Bitcoin had existed for approximately 18 months (since the January 2009 genesis block), but there was no centralized exchange infrastructure for Bitcoin-to-fiat trading. The Bitcoin Talk forum (launched November 2009) served as the primary community coordination venue, and early Bitcoin transactions were conducted peer-to-peer via forum posts and IRC channels. Mt. Gox was the first platform to provide a centralized order book, an automated trading engine, and a fiat-currency deposit/withdrawal interface — the three structural primitives that define the cryptocurrency exchange operational model to the present day.

Between July 2010 and early 2014, Mt. Gox grew to handle approximately 70% of all global Bitcoin trading volume, becoming the dominant price-discovery venue for Bitcoin and the primary on-ramp for new Bitcoin purchasers. The exchange's operational infrastructure included:

  • A centralized wallet architecture — user Bitcoin deposits were held in exchange-controlled wallets, not in user-controlled addresses. This made Mt. Gox the de-facto custodian of all user-deposited Bitcoin on the platform: the exchange held the private keys, and users held account balances in the exchange's internal ledger. This is the structural T11.001 surface: the exchange as third-party signing vendor, where a compromise of the exchange's wallet infrastructure produces customer-side loss.

  • A hot-wallet / cold-wallet architecture — the exchange maintained "hot wallets" (online, connected to the trading engine, used to process withdrawals) and "cold wallets" (offline, air-gapped, used for long-term storage of the majority of user deposits). The hot-wallet infrastructure was the operational attack surface: an attacker who compromised the exchange's servers could access the hot-wallet private keys and drain the online Bitcoin balances. This is the structural T15.003 surface: the operator's endpoint/infrastructure as the off-chain entry vector for wallet-key exfiltration.

  • A fiat-currency banking interface — the exchange maintained bank accounts in multiple jurisdictions (Japan, United States, Europe) to process fiat-currency deposits and withdrawals. The fiat-banking interface was the operational bottleneck that ultimately contributed to the exchange's collapse: withdrawal processing delays, banking-partner terminations, and the resulting customer-support crisis progressively degraded the exchange's operational integrity through 2013.

Jed McCaleb sold Mt. Gox to Mark Karpelès in March 2011. Under Karpelès's management, the exchange experienced a series of security incidents of increasing severity:

When Event OAK ref
2011-06-19 Mt. Gox auditor account compromised; BTC price manipulated to $0.01; ~2,000 BTC attempted withdrawal at manipulated price; Mt. Gox halts trading, rolls back transactions T15.003 (first documented exchange-access-level compromise)
2011-06 Days after the mid-June thefts, the Mt. Gox user database (reportedly 60,000+ users, including hashed passwords) leaked [mtgoxwiki]``[regmtgox] T15.003 (database-infrastructure compromise)
2014-02-10 Mt. Gox publicly blamed "transaction malleability" — a Bitcoin software bug letting someone alter transaction details so withdrawals appear not to have happened — for its withdrawal halt [mtgoxwiki]. Whether malleability was exploited earlier, or how much it explains of the loss, is not established by the sources cited here. T11.001 (exchange signing-infrastructure compromise via transaction-malleability exploit)
2014-02-07 Mt. Gox halts all Bitcoin withdrawals [mtgoxwiki] (operational shutdown begins)
2014-02-24 Mt. Gox website goes offline; all social media accounts deleted; internal "Crisis Strategy Draft" document leaked, revealing 744,408 BTC missing [mtgoxwiki] (exchange collapse)
2014-02-28 Mt. Gox files for bankruptcy protection in Tokyo District Court; reported liabilities of about ¥6.5B; Mt. Gox said it had lost almost 750,000 customer bitcoins and about 100,000 of its own [mtgoxwiki]``[mtgoxbbg] (bankruptcy filing)
2014-03-20 Mt. Gox announces discovery of 199,999.99 BTC in an old wallet, reducing the reported loss from about 850,000 to about 650,000 BTC [mtgoxwiki] (partial asset recovery)
2015-08-01 Mark Karpelès arrested in Japan [karpelesarrest] (criminal investigation)
2019-03-14 Tokyo District Court convicts Karpelès of falsifying data; 30-month sentence suspended for four years [mtgoxwiki]``[karpelesbbg] (criminal disposition)

The exchange's collapse in February 2014 was the defining event of the early Bitcoin era: it removed ~6% of the total Bitcoin supply from circulation (at that time), destroyed the dominant price-discovery venue, triggered a multi-year Bitcoin bear market (BTC price fell from ~$850 in February 2014 to ~$200 by January 2015), and established the template for exchange-failure investigation that every subsequent T11.001 + T15.003 case inherits.

What defenders should understand

  • Mt. Gox defined the "exchange as attack surface" category. Before Mt. Gox, there was no centralized cryptocurrency exchange infrastructure — Bitcoin was traded peer-to-peer. Mt. Gox created the three structural primitives that define the exchange operational model: a centralized order book, an automated trading engine, and a fiat-currency banking interface. These three primitives created the corresponding attack surfaces: the exchange's wallet infrastructure (T11.001), the exchange's operational infrastructure (T15.003), and the exchange's banking interface (operational risk surface, not directly OAK-tagged).
  • The "hot wallet / cold wallet" architecture was Mt. Gox's operational innovation — and its T15.003 attack surface. The hot-wallet infrastructure was the online, internet-connected component that processed customer withdrawals and maintained exchange liquidity. The hot wallet's private keys were stored on exchange servers connected to the internet — making server compromise equivalent to wallet compromise. This is the canonical T15.003 surface: the operator's endpoint/infrastructure as the off-chain entry vector for wallet-key exfiltration. Every subsequent exchange compromise (Bitfinex 2016, NiceHash 2017, Binance 2019, KuCoin 2020, Bybit 2025) inherits this surface.
  • Transaction malleability was the mechanism Mt. Gox itself blamed in February 2014. The Bitcoin protocol's transaction-ID (txid) computation included the transaction's input signatures, which could be modified (malleated) without invalidating the transaction. An attacker who submitted a withdrawal request to Mt. Gox could observe the broadcast transaction, malleate the signature (changing the txid), and rebroadcast the modified transaction. The modified transaction would confirm on-chain with a different txid than the one Mt. Gox's internal systems tracked. The attacker would then claim the withdrawal had failed (because Mt. Gox's systems couldn't find the original txid on-chain) and request a re-send — resulting in a double-payment from the exchange's hot wallet. Mt. Gox itself blamed this bug publicly on 2014-02-10 [mtgoxwiki]; the file does not establish how much of the loss it explains.
  • The Mt. Gox launch is an "infrastructure genesis" event, not a compromise event. At launch in July 2010, Mt. Gox had not yet been compromised. The file exists in OAK to document the launch of the infrastructure that defined the T11.001 + T15.003 attack surface for the subsequent decade. Investigators tracing exchange-compromise events to 2014+ should recognise Mt. Gox as the archetype that established the exchange operational model and the corresponding attack surfaces that every subsequent exchange-compromise event exploits.

Timeline (UTC)

When Event OAK ref
2007-01 Jed McCaleb registers mtgox.com as a Magic: The Gathering card-trading platform (pre-Bitcoin origin)
2010-07-18 McCaleb repurposes Mt. Gox for Bitcoin trading; exchange launches as first centralized BTC/USD marketplace infrastructure genesis — T11.001 + T15.003 attack surface created
2010–2011 Mt. Gox grows rapidly; becomes dominant Bitcoin exchange handling majority of global BTC trading volume (market-dominance phase)
2011-03 McCaleb sells Mt. Gox to Mark Karpelès Karpelès becomes CEO (operator transfer)
2011-06-19 Auditor account compromise (see examples/2011-06-mtgox-auditor-account-compromise.md) T15.003
2014-02-10 Mt. Gox blames transaction malleability for halted withdrawals (earlier exploitation not established in cited sources) T11.001
2014-02 Mt. Gox halts withdrawals; website offline; ~850,000 BTC missing revealed; bankruptcy filed (collapse)

Public references