Thousands of volunteering and self-organizing detectives have been meticulously laying a puzzle that reveals the Gox billion-dollar heist as an inside job. As smoke clears on the implosion of the Empty Gox bitcoin exchange, thousands of people in the community committed to revealing the truth behind the stonewalling exchange. What was claimed first to be a technical problem, then an outside theft, has been conclusively determined that the MtGox management knew too much, too long ago, to have this be an ordinary case of theft.
There are still many question marks remaining surrounding the missing 744,408 bitcoin at Empty Gox, valued at their peak to just under one billion US dollars, and which are well north of that in replacement value on the open market today. What’s becoming clear, though, is that this wasn’t a theft that properly shut down operations as soon as it was discovered. Instead, Empty Gox and its CEO Mark Karpeles appear to have attempted to benefit and profit from it. That would cross the line into criminal complicity, even if they were not part of the original loss – something that also remains an open question.
At this point, there are two outstanding principal questions:
- Who took the money?
- When was the money taken?
Let’s address the second question first and get the timeline in order, because it completes a lot of the puzzle. I have written before that it would be absolutely impossible to not notice the loss of one billion dollars from company assets, unless you were actively cooking the books to hide a gaping hole where a billion should have been. As it turns out, it seems such fraudulent cooking is exactly what has taken place.
An attempt at a timeline
Many different people have been working diligently to put together a timeline of events. Here’s an attempt to summarize the most important and credible ones.
June 2011 – the first possible time when the bitcoin in question might actually have disappeared (Jesse Powell). If true, Empty Gox has been operating with a lack of assets since, attempting to gradually cover the huge hole in its assets though operating profits. This would explain why there aren’t any books or balance sheets at all (Roger Ver), since making them would disclose the empty vault. Obviously, failing to disclose this would probably be at least criminal neglect toward shareholders, and quite possibly toward financial authorities as well.
June 23, 2011 – Under pressure to prove solvency, Karpeles moves a very specific huge amount of money (424,242 bitcoin) from one wallet to another. Thus, we know that he was in control of the target wallet of this transaction at this time, and can trace the funds forward from that point in time.
May 2, 2013 – Empty Gox was sued by CoinLab for 75 million USD for breach of contract. For unknown reasons, Gox failed to fulfill obligations to provide server access, resulting in a startup-crushing financial liability for failing to deliver. (Rob Banagale)
(Interestingly, there’s a massive selloff of 750,000 coins at an average price of about 100, totalling $75M, just following this event, suggesting customer coins were fraudulently sold to cover Gox liabilities. However, such a move wouldn’t make sense from a funding perspective, as it doesn’t change the amount customers have deposited in the exchange – if there was $75M deposited already, that could be used directly without a selloff; if there wasn’t, it would not magically appear because Gox sold customers’ coins on their own exchange.)
Summer 2013 – First Gox competitors get a significant foothold in the exchange market. Trading volume at Empty Gox, and therefore income from commissions, drops to one-third of pre-April levels.
August 2013 – First rumors that everything isn’t financially well with Empty Gox. Trouble with US Dollar withdrawals due to August 13 seizure of funds by US government. Nothing solid at this point, but in hindsight, this is when the game of musical chairs started (Weiner). The fractional reserve that was initiated some time 2011 has been holding up until this point.
September 10, 2013 – Empty Gox countersues CoinLab for five million US dollars in cash, which appears to have been withheld by CoinLab for some reason in a way Gox didn’t agree with. That would indicate Gox is now very short on cash. (Banagale)
October 20, 2013 – First report of a withdrawal from Empty Gox that didn’t go through, like an ATM executing a withdrawal but not dispensing any money. The stuck withdrawals are technically diagnosed by the community to be caused by an attempt at Empty Gox of spending the same money twice, which suggests that the Gox software believes it has money that it actually doesn’t. This is the date when Empty Gox management, at the latest point possible, must have been acutely aware that it was unable to serve withdrawals due to lack of funds. (Bryce Weiner)
November 26, 2013 – Last known transaction of the chain directly descending from the proof-of-solvency in June 2011 (easily manually traceable). On this date, Gox was able to access the cold storage that was used earlier, at least partially negating a “lost keys” theory.
December 2013 – People’s Bank of China announces an end to Chinese bitcoin trading by February 1, 2014. This causes Chinese to withdraw from Empty Gox in large numbers, depleting the reserves.
January 2014 – I try to empty my account at Gox. Bitcoin withdrawals are not coming through. It’s like emptying your account at an ATM but only getting dispensed a fraction of the money out of what was listed as withdrawn. Still not a large issue in the forums; you have to dig deep to find some technical discussion threads analyzing the withdrawal problems. Complaints to Gox get answered well after a week, at which point the balance is restored, and new withdrawals fail the same way. Rinse and repeat.
February 1, 2014 – Following the People’s Bank of China edict that times out on February 1, the amount of stuck withdrawals at Gox goes stratospheric enough for independent people to start tracking them on charts for debugging purposes.
February 4, 2014 – I publish my “38 million dollars missing at Gox” article, which is the first article to convert the question from a technical to a financial one, as far as I know. Several people would contact me after that article and hint that the situation was much worse than I could imagine.
February 7, 2014 – Gox shuts down bitcoin withdrawals entirely, citing technical problems and promising more information on February 10, a Monday.
February 9, 2014 – First recorded event of a so-called “transaction malleability attack” against the bitcoin blockchain, which Gox will blame the following day for all its ongoing problems. This contrasts with the fact that failed withdrawals occurred as early as October 20, 2013. (Weiner)
February 10, 2014 – Gox issues a press release explaining their halted withdrawals blaming problems with the bitcoin protocol as such, due to so-called “transaction malleability attacks”, and that they are working to solve the problem. This is immediately identitied as technical bullshit by a number of heavy names, plus myself.
February 15-17, 2014 – Empty Gox issues various “we’re working on it” updates, and gradually shuts down the exchange further, halting trading for six hours on February 15 for alleged maintenance and debugging. Gox promises an update on February 20.
February 19, 2014 – Gox moves to new offices according to a press release. The new address is a small virtual office in a rent-a-room business building in Tokyo, Cerulean Towers. Many in the community question the timing – you don’t move offices in the middle of a company existential crisis.
February 20, 2014 – Empty Gox issues a non-update to the situation, blaming delays caused by the office move, not giving a date for when its next update will follow. A few hours prior, there had been a massive selloff of coins on Gox, sending the price from $300 to $150, strongly suggesting insider trade (read: obviously showing).
Through February – People observing Gox actions remain hopeful at the slightest activity that things will sort out well in the end; some technical developments do take place. Meanwhile, the exchange rate of bitcoin tanks, especially on Empty Gox which is now isolated from the rest of the bitcoin economy. The exchange rate plummets from $1,000 per coin to sub-$100 per coin on Gox, and to about $600 on other exchanges. Allegedly, Karpeles is acting to profit personally from this difference in price, which is directly caused by his own mismanagement and shareholder deception, through active arbitrage (Selkis).
…Karpeles knew about the pervasive damage of the transaction malleability attacks for several weeks and was engaging in an arbitrage scheme that leveraged the depressed Mt. Gox price to reap gains on other exchanges. This was allegedly happening well before [February 25].
February 24, 2014 – A crisis strategy draft leaks, courtesy of Ryan Selkis, that indicates there has been a leak from Gox’ cold storage, leaving a hole of 744,408 bitcoin. As Andreas Antonopoulos points out, a “leak” from “cold storage” is a contradiction in terms: that means it either wasn’t a leak or it wasn’t cold storage. This document makes it clear that Empty Gox management knew that the problem wasn’t technical, and that they knew well what was going on:
For several weeks, MtGox customers have been affected by bitcoin withdrawal issues that compounded on themselves. Publicly, MtGox declared [...technical problems with the bitcoin protocol...]. [...] The truth is that the damage had already been done. At this point 744,408 bitcoin are missing…
February 25, 2014 – Empty Gox website goes completely blank. The music stops. This is consistent with the timeline presented in the “Crisis Strategy Draft” leaked the day before. The bitcoin exchange rate plummets to $400 per coin.
February 26, 2014 – The exchange rate of bitcoin has recovered completely from the shock of Empty Gox closing, back up to $600 per coin. Erik Voorhees notes that the bitcoin price fell less after the Gox implosion than the US equities fell after the Lehman implosion, which puts things in perspective. (Voorhees)
February 26, 2014 – Mark Karpeles posts a statement on the Gox website stating he is still in Japan and working to resolve the “recent issues” (see screenshot).
February 27, 2014 – Mark Karpeles’ neighbors say he moved out of his apartment in Tokyo a month ago (Kolin Burges).
February 27, 2014 – The 2014-2017 business plan of Gox leaks, courtesy of Ryan Selkis. It confirms the leaked document from February 24, and notably lacks any balance sheet. It reads very much like a prospectus aimed at courting buyers.
February 28, 2014 – Empty Gox files for bankruptcy protection, according to the Wall Street Journal (breaking at the time of writing).
This timeline, when seen from a zoomed-out perspective like this, paints a clear picture of a company – or at least a management – that was well aware of an insolvency, trying to actively deceive the community and shareholders, and profit personally from doing so.
Who took the money?
So, the trillion-dollar question: who took the money? Strictly speaking, we don’t know that yet. We’re talking about a sum of money so large that “humongous” and “enormous” aren’t sufficient to describe it – it’s 6% of all bitcoin in existence, and assuming bitcoin keeps growing to its potential, that means one individual is sitting on 6% of the world’s future trade and retail currency supply. In today’s USD value, such an amount would be on the order of 20 trillion US dollars, or roughly 250 times the fortune of today’s richest billionaire. It’s not exactly hard to see a motive here.
If this happened in the 2011 hack, then frankly, we have no idea. There are rumors floating around that Karpeles just lost the keys to the vault, that Gox has money stashed away, that the billion dollars are “temporarily unavailable”, and while an admirable theory to get hopes up that those keys may be found again, the zoomed-out picture says very clearly no such thing has happened. Somebody managing a company like this and treating it like his personal toy would have a personality that could well hint at all the money being just around the corner if you would only make a few more trades, acting just like any Prince of Nigeria. There is also unconfirmed research suggesting that Karpeles is in personal control of a very large amount of bitcoin (about 90,000) once used in the operations of Empty Gox; this research can be expected to be peer reviewed over the coming days. But no matter whether Karpeles personally robbed Gox blind, or profited personally on continuous deception from somebody else doing so in 2011 while deceiving clients and shareholders, it is clearly over the line into criminal territory and definition of an inside job.
In order to further boost hope in returning the money, there have been rumors of a buyout, apparently planted by Karpeles himself. Such rumors, getting hopes up that the client funds would be restored, turned out to be nothing but delusional bailout dreams from CEO Karpeles, as I predicted in my last article – while I understand the hopes of a competent management buying Gox, as I wrote, that’s a contradiction in terms. No competent management is going to go anywhere near this toxic crater. Instead, as revealed by bitcoin entrepreneur Ryan “Two-Bit Idiot” Selkis, once the businesses thus approached understood the magnitude of fraudulent mismanagement, they immediately notified authorities.
The silence from MtGox in general and its CEO Mark Karpeles in particular is stunning – and concerning – in this situation. A billion US dollars of clients’ money is missing, and the only public statement amounts to “stop asking us questions”.
In the first and only interview so far after the still-officially-unexplained shutdown, which has already led to multiple tragic suicides over the loss of fortunes, CEO Mark Karpeles responded to questions with a picture of his cat. This means that the communications skills from MtGox and Karpeles are either so carefully orchestrated here that only an experienced genius would understand them, or so incompetent that it falls below any description. Take a guess which is more probable.
According to research by Bryce Weiner, Karpeles himself is the person who took the funds, and this happened in 2011, which would be consistent with the observation by Jesse Powell (Weiner): “There’s nothing to indicate that Empty Gox was ever solvent.” While the timeline doesn’t conclusively show that Karpeles himself is behind the original disappearance of funds, it does show clear complicity in profiting from the heist.
As this article is almost finished, the Wall Street Journal reports that Empty Gox has just filed for bankruptcy.
According to an anonymous high-profile source, the first and original bitcoin scam was the online coin wallet Mybitcoin.com. People would deposit hundreds of thousands of coins there, as the currency was new and hundreds of thousands of coins weren’t yet worth a lot.
Then, on July 29, 2011, the site went blank, just like the Gox website did. People panicked and gradually accepted a catastrophic loss of funds.
On August 11, 14 days later, the site came back online and declared – just like Gox – that they “had been hacked”, had filed for bankruptcy protection, just like Gox, but “had managed to recover” 49% of the funds. People could fill out claim forms to recover these funds – 49% of their original balance. As this was enough time for most people to internalize the loss, they were happy again at the sudden windfall; things suddenly weren’t as bad as they had seemed. In the meantime, the anonymous person who ran mybitcoin.com disappeared with a huge amount of money, according to the source.
In other words, the scam cynically exploited people’s loss and grief to actually make them happy when they got something back. Most “hacks” of bitcoin sites since then have actually been copycat scams of mybitcoin.com, again according to this source. If – repeat, if Empty Gox is executing a copycat scam, we should expect the site to offer their clients a portion of the holdings back, a portion probably lower than 50% (just to drive the point home), and that offer should appear on or about March 11, 2014. Time will tell.
The one key difference between mybitcoin.com and MtGox would be that Mark Karpeles is not anonymous, which would make for a very poor execution of a copycat scam.
Live Updates Below
Mar 21 07:50 - MtGox has found 200,000 bitcoin which apparently were just laying around in a random drawer, following the scam blueprint to the letter, although on a slightly more drawn-out schedule.
Mar 03 20:45 - An article at CryptoCoinsNews, dealing with the past of Mark Karpeles, describes a previous business arrangement of Karpeles’ where he basically took the money and ran, bankrupting his business partner and not doing any of the contracted work. This fits very well with the overall image of a string of complete and untroubled deceptions and lies.
Mar 02 03:20 - Added more detail to the February 2014 timeline, with links to the now-gone press releases, courtesy of Internet Archive.
Mar 01 14:29 - Don’t miss the comments in the discussion thread over this article at /r/bitcoin on Reddit. Otherwise, mostly silence today on the matter. First relatively quiet day on the subject of Empty Gox in what feels like a month.
Mar 01 02:11 - Added the CoinLab lawsuits and the 2011 proof-of-solvency to the timeline. They are both relevant in context.
Feb 28 18:22 - According to the bankruptcy filings, the situation is even worse than previously imagined: 64 million US dollars and 850,000 bitcoin are missing.
Feb 28 14:47 - Unconfirmed just now (via Joanne Heidi): It seems Karpeles is seeking a reconstruction of Empty Gox though bankruptcy proceedings and to pay back account holders partially with a reconstructed company. If true, it continues the blueprint copycat scam.
Feb 28 13:08 - It’s possible to watch Mark Karpeles in the Japanese press conference declaring the bankruptcy. His body language is interesting to observe.
Feb 28 11:27 - A class action lawsuit has been filed that sues Mark Karpeles, MtGox Inc (US), MtGox KK (JP), and Tibanne KK (JP) for pretty much all of the above.
Feb 28 11:20 - Live updates, additions, and/or corrections will be posted here as the story keeps unfolding. All timestamps are European.
As stated before, I lost 160 coins in this event, but I managed to get a majority of my holdings out in time. My heart and thoughts are with those in our community who lost everything, regardless of amount.