Mt. Gox

Mt. Gox logo.

Mt. Gox was a Bitcoin exchange based in Tokyo, Japan. Programmer Jed McCaleb launched it as a Bitcoin market in July 2010 and transferred control to Mark Karpelès in 2011. By the first half of 2013 it handled nearly three quarters of reported Bitcoin exchange trading, making it the dominant custodial exchange in Bitcoin's early market.

Mt. Gox stopped customer Bitcoin withdrawals and trading in February 2014 after years of security, accounting, banking and operational failures. It initially reported approximately 850,000 BTC missing, then found 200,000 BTC in an old wallet. The resulting insolvency, litigation and investigation are covered in Collapse of Mt. Gox.

The company's estate entered Japanese civil rehabilitation in 2018. A court-approved plan became final in 2021, and the trustee began cryptocurrency repayments to some creditors in 2024.

Name and founding

McCaleb registered the domain mtgox.com for a proposed market in cards used by the game Magic: The Gathering Online; the name abbreviated “Magic: The Gathering Online eXchange”. The card market was short-lived. After learning about Bitcoin, McCaleb reused the domain for an exchange that opened on 18 July 2010.

In 2011, McCaleb transferred the exchange to French developer Mark Karpelès, who operated it through the Japanese company Tibanne. Trading volume grew rapidly under Karpelès, but the technical and financial controls did not keep pace with the exchange's role.

Operation

Customers deposited national currency or Bitcoin into accounts controlled by Mt. Gox. Trades were matched inside the company's database and could execute immediately without waiting for a Bitcoin transaction between buyer and seller. A blockchain transaction was required when Bitcoin entered or left the exchange, not for each internal trade.

This structure made trading convenient but custodial. Account balances were claims on Mt. Gox, and customers depended on the company to maintain accurate internal records, segregate assets, secure private keys and process withdrawals. A trade displayed by the exchange did not by itself prove that the corresponding bitcoins existed in a wallet controlled for customers.

Security and operational problems

In June 2011, an attacker used credentials from a compromised auditor account to place fraudulent sell orders, briefly driving the displayed Bitcoin price on Mt. Gox to one cent. The exchange halted service and rolled back the affected trades. A separate disclosure exposed its user database, including email addresses and password hashes, prompting other Bitcoin services to review accounts whose users had reused credentials. The incident showed weaknesses in access control, password protection and database security.

Independent investigators later concluded that a separate loss of wallet funds had begun by late 2011. WizSec's reconstruction of leaked records and blockchain transactions found repeated transfers from Mt. Gox wallets without corresponding withdrawal entries. According to that analysis, the exchange was substantially depleted of bitcoins by 2013 while its database continued to show customer balances.

Banking, litigation and withdrawal delays

In February 2013, Mt. Gox announced that CoinLab would handle its U.S. and Canadian business. The transfer did not take effect as planned. CoinLab sued Mt. Gox in May for US$75 million, alleging breach of the parties' agreement; Mt. Gox later alleged in a counterclaim that CoinLab had retained US$5.3 million in customer deposits. These were contested civil claims, not findings about the later Bitcoin theft.

U.S. authorities also seized more than US$5 million from accounts associated with Mt. Gox after alleging that its American subsidiary had represented to a bank that it did not transfer funds for customers and had not registered as a money-services business. Mt. Gox subsequently registered with the Financial Crimes Enforcement Network.

Access to banking remained constrained. Mt. Gox paused U.S.-dollar withdrawals in June 2013 and later said they had resumed, but customers continued to report delays of weeks or months. In November, Wired reported that the Japanese bank handling outgoing payments was limiting the exchange to ten international wire transfers per day. These cash bottlenecks were distinct from the undisclosed shortage in the company's Bitcoin wallets, but both undermined customers' ability to withdraw.

2014 closure

Mt. Gox halted Bitcoin withdrawals on 7 February 2014 and blamed transaction malleability, a property that allowed a transaction identifier to change without changing the payment. Other exchanges adjusted their withdrawal systems, but Mt. Gox did not reopen. A later study of blockchain data found that transaction-malleability attacks could not explain the scale of the missing bitcoins.

Karpelès resigned from the Bitcoin Foundation's board on 23 February. The exchange suspended trading on 24 February and its website went offline. Six other Bitcoin businesses issued a joint statement separating Mt. Gox's insolvency from the operation of Bitcoin itself.

On 28 February, the company sought civil rehabilitation in Tokyo. It reported about 750,000 customer bitcoins and 100,000 company bitcoins missing, liabilities of approximately US$63.6 million and assets of approximately US$37.7 million. Mt. Gox sought recognition of the Japanese proceeding under Chapter 15 of the U.S. Bankruptcy Code in March. The Tokyo court rejected the attempted rehabilitation in April and placed the company into bankruptcy liquidation. In March, Mt. Gox disclosed that it had recovered 200,000 BTC in an old-format wallet, reducing the reported missing total to about 650,000 BTC.

Investigations and criminal cases

In 2017, U.S. prosecutors alleged that BTC-e and its operator Alexander Vinnik laundered funds connected to the Mt. Gox theft. A 2023 indictment separately charged Alexey Bilyuchenko and Aleksandr Verner with conspiring to hack Mt. Gox and launder approximately 647,000 BTC. These charges are allegations, not findings of guilt.

Japanese prosecutors charged Karpelès over manipulation of Mt. Gox's records and alleged misuse of funds. In 2019, the Tokyo District Court convicted him of falsifying electronic data and gave him a suspended sentence, while acquitting him of embezzlement. The judgment did not find that Karpelès committed the large wallet theft.

Bankruptcy and civil rehabilitation

Bankruptcy proceedings collected the company's remaining assets and established creditor claims. The estate retained a substantial amount of recovered Bitcoin. As Bitcoin's price increased, distributing the assets under ordinary bankruptcy rules risked valuing customer claims at an early yen price and leaving later appreciation for shareholders.

The proceedings required the trustee to reconcile account records, ownership disputes and claims denominated in several currencies. In February 2016, the trustee reported that 24,733 people had filed bankruptcy claims, including 9,863 who had filed Bitcoin-only claims through the trustee or Kraken's online service. The later rehabilitation process also recognized some claims from exchange records even where the customer had not submitted an earlier bankruptcy proof. A filed or self-approved claim is not necessarily identical to an allowed distribution amount.

On 22 June 2018, the Tokyo District Court commenced civil rehabilitation and stayed the bankruptcy proceeding. Creditors approved a rehabilitation plan in 2021; the confirmation order became final and binding on 16 November 2021.

The plan offered different repayment methods involving cash and, for eligible cryptocurrency claims, Bitcoin and Bitcoin Cash through designated exchanges. The trustee reported cryptocurrency distributions on several dates in July and August 2024 and from January through March 2025. As of 13 September 2026, the official deadline for base, early lump-sum and intermediate repayments was 31 October 2026, and some eligible creditors had not yet completed repayment.

Legacy

Mt. Gox became a central example of custodial exchange risk. Its internal ledger could credit trades even though users could not independently verify the exchange's aggregate wallet balance or liabilities. The collapse encouraged exchanges, auditors and users to focus on segregation of assets, wallet controls, withdrawal testing and cryptographic proof-of-reserves methods, although proof of wallet assets alone does not establish liabilities or solvency.

The failure did not reverse transactions on the Bitcoin blockchain or compromise Bitcoin's signature scheme. It exposed weaknesses in an intermediary that held users' keys and maintained a private accounting system. That distinction remains important when comparing protocol risk with the operational and legal risks of a custodian.

External links

• Rehabilitation trustee announcements
• WizSec investigation