The Missing Mt. Gox Bitcoins

http://blog.wizsec.jp/2015/04/the-missing-mtgox-bitcoins.html

by dwwoelfel • 11 years ago

168 89 11 years ago

blog.wizsec.jp

The author states that the bitcoins were stolen over time, however, the graph shows that between June and November 2011 there is a gap due to missing data. It then opens in November 2011 with a huge gap between actual btc and expected btc of some 500k bitcoins. Practically almost all the "missing" bitcoins. Suggesting therefore that either they were "lost" sometime between June-November 2011 or they were hidden at the time somewhere on blockchain or that the authors have made some sort of mistake.

I am not sure how such a huge amount of bitcoins can be "lost" within such a short period of 4 months. Leaving open the option that there may be some mix up with the internal data or that the analysis is incomplete.

mikkom• 11 years ago

Doesn't this cover it quite well?

The "gap" in the left-most part of the graph is caused by MtGox bitcoins that we temporarily lose track of (likely as they pass through old cold storage that we have not yet mapped out). They later reappear in known addresses, which marks the "end" of the gap.

wongarsu8• 11 years ago

And the third graph (the difference between observed and expected BTC holdings) nicely supports that. Almost all of the BTC from that gap reappear.

mrb• 11 years ago

Doesn't this cover it quite well?

No it doesn't. What Andrew_Quentin meant is that even ignoring the gap (grey line) or taking it into account (red line), both show that 500k BTC are missing by Nov 2011, and this all happened in a mere 5 months, between Jun and Nov: http://4.bp.blogspot.com/-Np_kU7aOZOY/VS_HpjyMq2I/AAAAAAAAC3...

I find it surprising that WizSec doesn't advance the following theory, but it is likely that the same hacker from the disastrous June 2011 hacking incident (which I blogged about; http://blog.zorinaq.com/?e=55) is responsible for stealing the MtGox bitcoins which started disappearing right around this time.

wongarsu8• 11 years ago

Something I find eye-catching is that from Jul-Oct 2011, just shortly after the proof of solvency, the expected BTC holdings double while the observed BTC holdings don't seem to move very much. If that was a random hacker attack it would be exceptionally good timing.

wongarsu8• 11 years ago

How do they know that those BTC went to exchanges? The probably can check which BTC went back to Mt Gox, but how do they know that a particular receiving address belonged to e.g. Bitcoinica?

FatalLogic• 11 years ago

One probable method would be to look at the addresses that other people used to deposit to an exchange. Many people make this public, for various reasons.

I assume the investigators would see a pattern of many small deposits being moved directly from those deposit addresses into the exchange's hot and cold wallets, which contained large amounts of money. That pattern could be recognized and the exchange's main wallets identified beyond reasonable doubt. Withdrawals from the exchange could also be tracked, I assume. Probably there is more sophisticated analysis of addresses clusters involved too.

abrkn• 11 years ago

http://www.walletexplorer.com/

frevd• 11 years ago

How do you convert big amounts of bitcoins into cash, even over time, without leaving a trace? Isn't there bank account information involved leading to individuals, which a criminal investigation could request?

JoeAltmaier2• 11 years ago

Fundamentally, Bitcoin is about not having any of that info. If it were a responsible financial institution, then there would have been federal regulations regarding reporting, reserves etc. But the miracle of bitcoins is, somehow it isn't subject to any reasonable oversight.

07d0462• 11 years ago

Yes, almost all of the advantages of Bitcoin are because it currently has practically no regulatory oversight. If it was to get mainstream usage, regulation would also grow, and at least if you want to play in licit channels, it would be almost exactly the same as what already exists. Being your own bank is much too hard and risky for the average consumer, and payment systems that provide useful consumer protections like chargebacks would be formed, so in the end, most people would be doing their banking at BitChase and using a BitVisa credit card.

wyager3• 11 years ago

If it were a responsible financial institution

Are you under the impression that it's an institution at all?

The whole reason Bitcoin is interesting is that it's not under the control of a company, group, or government.

IkmoIkmo5• 11 years ago

Bitcoin is pretty much digital cash. There is no institution that governs the transfer of cash, as in if you pay at a store with cash, or pay a friend cash, or pay a criminal cash, or buy some drugs with cash, there's no 3rd party involved here like say a Paypal or bank transfer.

Bitcoin is like that.

But like bitcoin and cash, institutions are part of the ecosystem. You likely get paid by regulated organisations such as an employer or company, you may store your cash with a third party like Paypal, a bank or a bitcoin wallet service like Coinbase. You may exchange your cash into a different currency, or have a company send your cash somewhere, and institutions are involved just like with bitcoin.

And all these organisations are generally subject to the same, or stricter regulatory oversight. In most states for example, bitcoin companies are considered money transmitters and subject to your regular money transmitter laws. And in some states like New York, actual bitlicenses are being designed to specifically provide bitcoin/cryptocurrency regulations in addition to these laws, not replacing them.

The fact that not everyone uses institutions, or that some illegal institutions exist (just like how some use cash without using banks see [0], or use illegal organisations for their financial services (e.g. Hawala remittance services instead of Western Union, illegal in many countries), is no different from people using bitcoin without involving an institution, or using bitcoin services that don't follow their regulatory obligations. (the minority of popular wallet companies, exchanges etc, btw).

So... no miracle here. It's extremely similar to cash as we know it. Not exactly similar of course.

wongarsu8• 11 years ago

Bitcoin exchanges are requiring more and more information to conform to money laundering regulations. In most countries Bitcoins are regulated either as currency, foreign currency or investment similar to stock. Some countries haven't quite made up their mind yet, but the real reason for the lack of comprehensive oversight is that it's so easy to operate a bitcoin business anonymously, escaping all regulation.

hypron• 11 years ago

The only "trace" that you could find would be a wire transfer from an exchange to a bank account, and even that isn't too suspicious, because I would imagine that large exchanges do that regularly.

You could also sell the bitcoins for cash in person over time, and avoid any traces.

belorn• 11 years ago

Selling publicly known stolen bitcoins seems to me as a rather difficult task. Exchanges could refuse dealing with those addresses, and researchers would surely jump if they noticed a set of dormant addresses suddenly starting to see usage. It seems as the same problem as art thieves have, as even if their identity can be hidden, the goods they try to sell are inherently identifiable.

navait• 11 years ago

There have been some efforts out there to provide completely anonymous bitcoin transactions, namely ZeroCoin and bitcoin mixers like Silk Road used. After these services are used, t becomes impossible to track the coins origins.

http://isi.jhu.edu/~mgreen/ZerocoinOakland.pdf

bduerst5• 11 years ago

Exchanges could but they definitely don't have a black list of dormant/fraudulent addresses somewhere.

These people could also tumble the bitcoins, where they convert it to an alt coin or other currency before converting back to a different address. That's how money launderers currently use bitcoin now and bypass the whole "public record" thing.

IkmoIkmo5• 11 years ago

Not much different from other stolen goods like jewellery. It has value, people want to pay for it ignorant or disregarding of its (stolen) origins. You do it in person. The buyer has limited culpability. In addition, after some time (I don't know the English legal term for this), ownership transfers from the victim to whoever possesses it for long enough. (i.e. if B steals a bike from A, and sells it to C, then C possesses the bike but doesn't legally own it, ownership is still with A. But after a while, ownership transfers to C. At least in many legal systems). The sale occurs in cash and identities are generally not registered.

In other words, the banking system is circumvented and everything is done with cash. The other option is to employ the banking system in a way that is also used for business fraud in general: use throw away accounts from socioeconomically fragile and 'disposable' people. Criminals will approach someone who is (semi) homeless, or a minor in high school. They probably have a bank account with $50 on it. You pay them $100 for their ATM card & bank account and promise more with some story, e.g. employment as 'jr. financial controller' in the criminals' non-existent company. The victims (who fall for it) argue to themselves "I have $50, I get $100, and have been promised $500 more, what do I have to lose?"

Will there be people who deny this opportunity? Yes, probably most. Will there be people who won't? Yes. And you only need a single card and you can run 3-5 days of scams on it before the account gets reported, flagged and blocked. And you can run thousands of dollars of money through in that period.

The criminal now has a regulated bank account on which he can receive payments without it leading back to his identity. At this point you can scam people on Craigslist (send me $200 for the Playstation and I'll send it to you asap, do it at 3AM and it won't get deleted manually by an admin, and you'll find 3-4 people who'll fall for a too good to be true price because they're desperate), or indeed actually sell stolen bitcoins at 95% of market value (inviting arbitrage who will buy up everything you have).

You then go to the bank, use your card to withdraw everything, and disappear. The guy who gave you his card gets a call from the police and tells his story. Sometimes he gets a minor fine, but generally he is a victim, too and has no means of covering any damage.

Will there be people who deny stolen bitcoins? Yes. Will there be people who either have no clue at all which bitcoins were recently stolen or not, or if they do, not care? Yes.

It's really messed up and pretty fool-proof. The big criminals get caught eventually. (they leak information to friends who report them. They run $500k of scams through Craigslist and get priority and get traced via their ISP, usually they barely know what an IP is). Or they do this + a bunch of other stuff like break ins and get caught when the police finds $100k in cash at their home. Or they get reported trying to recruit lots of kids for their debit cards etc. But I'd bet if you did it small-time/smartly you could easily get away with it.

keypusher• 11 years ago

Not necessarily. You could easily funnel the coins through multiple addresses, and then use them to pay for illicit goods, which would then be sold on the black market. Or you could use them at a gambling site which returns real money. Techniques like these are often used by organized crime to launder money, I imagine with btc it is even easier.

fugyk• 11 years ago

Why hasn't Mt. Gox disclosed what they know about the attack?

Mahn• 11 years ago

Reportedly because the police is still investigating the case and publicizing everything could harm the (slim) chances of finding the criminals.

lifeisstillgood• 11 years ago

What I take away from this is that despite a totally open and visible accounting system (the blockchain) it is still possible to hide transactions - no wonder we have been stuffed preventing tax evasion.

bewaretheirs• 11 years ago

The author says "MtGox operated at fractional reserve for years". A better and more conventional way to put it: it was insolvent for years.

dec0dedab0de2• 11 years ago

aren't they essentially the same thing?

haberman• 11 years ago

When you operate a fractional reserve, other people/businesses owe you at least as much money as you owe to your deposit accountholders.

When you're insolvent, you can't cover your obligations. Even if you called in every loan you'd made, it still wouldn't give you enough cash that all your deposit account customers could withdraw all their money.

Calling Mt. Gox a "fractional reserve" is giving them way too much credit.

imaginenore• 11 years ago

No. Fractional reserve assumes people owe you and your books balance perfectly fine.

Insolvency means you fucked up.

Lazare• 11 years ago

Insolvent: Liabilities exceed assets.

Illiquid: Immediate demands for cash exceed liquid assets.

Fractional reserve banking: Short term deposits are lent out as long term loans.

Under normal conditions, a bank has capital (ie, its assets exceed its liabilities). The capital acts as a cushion, which means it is not insolvent, and not likely to become insolvent.

On the other hand, fractional reserve banks are prone to liquidity crises (aka, a bank run), because while the bank will pretty much always have enough assets to give all depositors their money back, it will pretty much never have enough to do so immediately. Which is why real banks have depositor insurance (and also why depositor insurance is affordable to provide).

The article is describing MtGox as being insolvent; and despite incorrectly using the term, it's not describing fractional reserve banking, and the two are not the same thing. MtGox didn't make long term loans (or any loans), and it did not suffer a liquidity crisis. It was insolvent because the money was stolen. It's a vastly different thing.

christbitcoin2• 11 years ago

No.

If I accept $10 in deposits, make $8 in loans, and have $3 of cash on hand, I'm operating a fractional reserve.

I have $11 in assets ($3 cash, and $8 of loans receivable), and $10 in liabilities (cash owed to depositors). There's some risk if my loans go bad, but it's fundamentally sane.

Insolvency, on the other hand would be if I accept $10 in deposits, make $8 in loans, and have $0 cash on hand.

At this point, I'm insolvent. There's no reason to believe I can pay back my depositors because my liabilities are greater than my assets. Even if all the loans are repaid, I simply don't have the money.

Animats• 11 years ago

It's embarrassing for the Tokyo Metropolitan Police that they haven't cracked this case yet. They're one of the biggest police departments in the world and have extensive resources. Yes, their in-house computer crime department is new, but they could draw on expertise at the national level or from outside Japan.

damian2000• 11 years ago

I read a book recently that went into some detail about tokyo police's methods regarding a series of murders in the 1990s/2000s. In that account at least they didn't seem very compentent in their investigative skills - they were largely focused on getting confessions from people. Probably not relevant to the MtGox case.

http://www.goodreads.com/book/show/7555367-tokyo-hostess

Sealy• 11 years ago

Thank you for these posts. We need to keep awareness of the issue as high as possible as it will become easier and easier for both the forces and liquidators to dilute the funds left for payout down to nothing over time.

The Missing Mt. Gox Bitcoins

Related Stories