Loss: n/a (genesis event — infrastructure launch, not a compromise event). The Mt. Gox exchange would later become the site of the largest exchange compromise in Bitcoin history: approximately 850,000 BTC (~$450M at 2014-02 prices) lost or stolen over a multi-year period culminating in the exchange's February 2014 collapse. OAK Techniques observed: none — infrastructure-genesis event, not a compromise event. The Mt. Gox operational surface that would later be exploited is the canonical attack surface for T11.001 (Third-Party Signing Vendor Compromise — the exchange as wallet-custodian for user deposits) and T15.003 (Operator Endpoint/Infrastructure Compromise — the exchange's operational infrastructure as the off-chain entry vector for wallet-key exfiltration). The Mt. Gox launch is the structural ancestor of these two Technique surfaces: the exchange-as-custodian pattern that T11.001 documents and the operator-infrastructure-as-attack-vector pattern that T15.003 documents both trace their lineage to the Mt. Gox operational model established at launch in July 2010. Attribution: unattributed n/a (infrastructure launch). Mt. Gox was founded by Jed McCaleb (who had originally created the domain as a trading platform for Magic: The Gathering cards — "Magic: The Gathering Online eXchange" → "Mt. Gox") and was repurposed for Bitcoin trading in July 2010. McCaleb sold the exchange to Mark Karpelès in March 2011. Karpelès was subsequently arrested in Japan in August 2015 on charges of embezzlement and data manipulation related to the exchange's collapse; he was convicted in March 2019 of data-manipulation charges (sentence: 2.5 years, suspended for 4 years) and acquitted of embezzlement charges. Key teaching point: The Mt. Gox launch in July 2010 establishes the canonical "exchange as attack surface" pattern that OAK-T11.001 and OAK-T15.003 document as two of the most consequential Technique surfaces in the cryptocurrency incident record. Investigators tracing exchange-compromise events from 2014 forward should understand Mt. Gox as the archetype that defined the category: the first exchange to achieve systemic market dominance (~70% of all BTC trading volume at its peak), the first exchange whose operational infrastructure was compromised at scale, and the incident whose collapse (2014-02) established the template for exchange-failure investigation that every subsequent T11.001 + T15.003 case inherits. Mt. Gox is not itself a T11.001 or T15.003 incident at launch — it is the infrastructure whose operational surface defined the attack class.
Mt. Gox launched in July 2010 as the first major Bitcoin exchange. The domain (mtgox.com) was originally registered by Jed McCaleb in 2007 as a trading platform for Magic: The Gathering cards (the name "Mt. Gox" derived from "Magic: The Gathering Online eXchange"). In July 2010, McCaleb repurposed the platform for Bitcoin trading after reading about Bitcoin on the Slashdot forum and recognizing the need for a centralized marketplace where Bitcoin could be exchanged for fiat currency.
The exchange's launch timing was structurally significant: Bitcoin had existed for approximately 18 months (since the January 2009 genesis block), but there was no centralized exchange infrastructure for Bitcoin-to-fiat trading. The Bitcoin Talk forum (launched November 2009) served as the primary community coordination venue, and early Bitcoin transactions were conducted peer-to-peer via forum posts and IRC channels. Mt. Gox was the first platform to provide a centralized order book, an automated trading engine, and a fiat-currency deposit/withdrawal interface — the three structural primitives that define the cryptocurrency exchange operational model to the present day.
Between July 2010 and early 2014, Mt. Gox grew to handle approximately 70% of all global Bitcoin trading volume, becoming the dominant price-discovery venue for Bitcoin and the primary on-ramp for new Bitcoin purchasers. The exchange's operational infrastructure included:
-
A centralized wallet architecture — user Bitcoin deposits were held in exchange-controlled wallets, not in user-controlled addresses. This made Mt. Gox the de-facto custodian of all user-deposited Bitcoin on the platform: the exchange held the private keys, and users held account balances in the exchange's internal ledger. This is the structural T11.001 surface: the exchange as third-party signing vendor, where a compromise of the exchange's wallet infrastructure produces customer-side loss.
-
A hot-wallet / cold-wallet architecture — the exchange maintained "hot wallets" (online, connected to the trading engine, used to process withdrawals) and "cold wallets" (offline, air-gapped, used for long-term storage of the majority of user deposits). The hot-wallet infrastructure was the operational attack surface: an attacker who compromised the exchange's servers could access the hot-wallet private keys and drain the online Bitcoin balances. This is the structural T15.003 surface: the operator's endpoint/infrastructure as the off-chain entry vector for wallet-key exfiltration.
-
A fiat-currency banking interface — the exchange maintained bank accounts in multiple jurisdictions (Japan, United States, Europe) to process fiat-currency deposits and withdrawals. The fiat-banking interface was the operational bottleneck that ultimately contributed to the exchange's collapse: withdrawal processing delays, banking-partner terminations, and the resulting customer-support crisis progressively degraded the exchange's operational integrity through 2013.
Jed McCaleb sold Mt. Gox to Mark Karpelès in March 2011. Under Karpelès's management, the exchange experienced a series of security incidents of increasing severity:
| When | Event | OAK ref |
|---|---|---|
| 2011-06-19 | Mt. Gox auditor account compromised; BTC price manipulated to $0.01; ~2,000 BTC attempted withdrawal at manipulated price; Mt. Gox halts trading, rolls back transactions | T15.003 (first documented exchange-access-level compromise) |
| 2011-09 | Mt. Gox database leaked; ~60,000 user records (usernames, email addresses, hashed passwords) exposed | T15.003 (database-infrastructure compromise) |
| 2011-2013 (ongoing) | "Transaction malleability" exploited to withdraw BTC from Mt. Gox hot wallets — attackers submitted withdrawal requests, modified the transaction ID (txid) before confirmation, and claimed the withdrawal had failed, prompting Mt. Gox to re-send the BTC; the modified transaction had in fact confirmed, resulting in double-payment from the exchange's wallets. The precise start date and total magnitude of transaction-malleability-based extraction are disputed, but the technique was a known Bitcoin-protocol property from 2011 onward. | T11.001 (exchange signing-infrastructure compromise via transaction-malleability exploit) |
| 2014-02-07 | Mt. Gox halts all Bitcoin withdrawals, citing "transaction malleability" issue | (operational shutdown begins) |
| 2014-02-24 | Mt. Gox website goes offline; all social media accounts deleted; internal "Crisis Strategy Draft" document leaked, revealing |
(exchange collapse) |
| 2014-02-28 | Mt. Gox files for bankruptcy protection in Tokyo District Court; liabilities of |
(bankruptcy filing) |
| 2014-03-20 | Mt. Gox announces discovery of |
(partial asset recovery) |
| 2015-08-01 | Mark Karpelès arrested in Japan on charges of embezzlement and data manipulation | (criminal investigation) |
| 2019-03-15 | Karpelès convicted of data-manipulation charges (sentence: 2.5 years, suspended for 4 years); acquitted of embezzlement | (criminal disposition) |
| 2021-11 | Mt. Gox civil rehabilitation plan approved; creditors to receive ~90% of recoverable assets (~150,000 BTC at 2021 prices) | (creditor resolution) |
| 2024-07 | Mt. Gox trustee begins distributing ~$9B in recovered BTC/BCH to creditors | (ongoing distribution) |
The exchange's collapse in February 2014 was the defining event of the early Bitcoin era: it removed ~6% of the total Bitcoin supply from circulation (at that time), destroyed the dominant price-discovery venue, triggered a multi-year Bitcoin bear market (BTC price fell from ~$850 in February 2014 to ~$200 by January 2015), and established the template for exchange-failure investigation that every subsequent T11.001 + T15.003 case inherits.
- Mt. Gox defined the "exchange as attack surface" category. Before Mt. Gox, there was no centralized cryptocurrency exchange infrastructure — Bitcoin was traded peer-to-peer. Mt. Gox created the three structural primitives that define the exchange operational model: a centralized order book, an automated trading engine, and a fiat-currency banking interface. These three primitives created the corresponding attack surfaces: the exchange's wallet infrastructure (T11.001), the exchange's operational infrastructure (T15.003), and the exchange's banking interface (operational risk surface, not directly OAK-tagged).
- The "hot wallet / cold wallet" architecture was Mt. Gox's operational innovation — and its T15.003 attack surface. The hot-wallet infrastructure was the online, internet-connected component that processed customer withdrawals and maintained exchange liquidity. The hot wallet's private keys were stored on exchange servers connected to the internet — making server compromise equivalent to wallet compromise. This is the canonical T15.003 surface: the operator's endpoint/infrastructure as the off-chain entry vector for wallet-key exfiltration. Every subsequent exchange compromise (Bitfinex 2016, NiceHash 2017, Binance 2019, KuCoin 2020, Bybit 2025) inherits this surface.
- Transaction malleability was the T11.001 primitive deployed against Mt. Gox. The Bitcoin protocol's transaction-ID (txid) computation included the transaction's input signatures, which could be modified (malleated) without invalidating the transaction. An attacker who submitted a withdrawal request to Mt. Gox could observe the broadcast transaction, malleate the signature (changing the txid), and rebroadcast the modified transaction. The modified transaction would confirm on-chain with a different txid than the one Mt. Gox's internal systems tracked. The attacker would then claim the withdrawal had failed (because Mt. Gox's systems couldn't find the original txid on-chain) and request a re-send — resulting in a double-payment from the exchange's hot wallet. This technique was a known Bitcoin-protocol property from 2011; Mt. Gox's internal systems did not account for it.
- The Mt. Gox launch is an "infrastructure genesis" event, not a compromise event. At launch in July 2010, Mt. Gox had not yet been compromised. The file exists in OAK to document the launch of the infrastructure that defined the T11.001 + T15.003 attack surface for the subsequent decade. Investigators tracing exchange-compromise events to 2014+ should recognise Mt. Gox as the archetype that established the exchange operational model and the corresponding attack surfaces that every subsequent exchange-compromise event exploits.
| When | Event | OAK ref |
|---|---|---|
| 2007 | Jed McCaleb registers mtgox.com as a Magic: The Gathering card-trading platform | (pre-Bitcoin origin) |
| 2010-07-17 | McCaleb repurposes Mt. Gox for Bitcoin trading; exchange launches as first centralized BTC/USD marketplace | infrastructure genesis — T11.001 + T15.003 attack surface created |
| 2010–2011 | Mt. Gox grows rapidly; becomes dominant Bitcoin exchange handling majority of global BTC trading volume | (market-dominance phase) |
| 2011-03 | McCaleb sells Mt. Gox to Mark Karpelès (Tibanne Ltd.); Karpelès becomes CEO | (operator transfer) |
| 2011-06-19 | Auditor account compromise (see examples/2011-06-mtgox-auditor-account-compromise.md) |
T15.003 |
| 2011–2013 | Ongoing transaction-malleability exploitation; BTC progressively drained from Mt. Gox hot wallets | T11.001 |
| 2014-02 | Mt. Gox halts withdrawals; website offline; ~850,000 BTC missing revealed; bankruptcy filed | (collapse) |
- Mt. Gox exchange operational archive — primary-source materials from the exchange's 2010–2014 operational period, including trading-engine architecture, wallet-infrastructure documentation, and incident-response communications.
- Mt. Gox bankruptcy proceedings — Tokyo District Court civil rehabilitation case materials; creditor claims; trustee reports.
- Mark Karpelès criminal proceedings — Tokyo District Court criminal case materials; data-manipulation conviction (March 2019); embezzlement acquittal.
examples/2011-06-mtgox-auditor-account-compromise.md— Mt. Gox auditor account compromise (2011-06-19) — the earliest documented T15.003 incident at Mt. Gox.examples/2014-02-mt-gox.md— Mt. Gox exchange collapse (2014-02) — the terminal T11.001 + T15.003 event; the largest exchange compromise in Bitcoin history.[mtgox2014postmortem]— the leaked "Crisis Strategy Draft" document (February 2014) — primary-source disclosure of the ~744,408 BTC shortfall and the transaction-malleability exploitation vector.[karpeles2019verdict]— Tokyo District Court verdict in the Karpelès criminal case (March 2019).