Mt. Gox: the hack that lost 850,000 bitcoins

What happened to Mt. Gox? Mt. Gox, a Tokyo-based exchange that handled most of the world's bitcoin trading around 2013, stopped withdrawals in February 2014 and filed for bankruptcy on 28 February 2014. It said about 850,000 bitcoins were missing – roughly 7% of all bitcoins in existence at the time. About 200,000 BTC were later found; customers began receiving repayments only in July 2024, more than ten years later.

Mt. Gox was not a bank, a fund or even a proper exchange when it started. Its name stands for "Magic: The Gathering Online eXchange" – a website for trading fantasy card games. Somewhere between the dragons and the wizards, it ended up holding a large share of all the bitcoins in the world. What could possibly go wrong?

How did a card website become a bitcoin giant?#

Programmer Jed McCaleb registered mtgox.com in 2007 for trading game cards. In 2010 he turned the dormant site into a bitcoin exchange, and in 2011 he sold it to Mark Karpelès, a French developer living in Japan. Bitcoin was tiny and almost nobody else offered an easy way to buy it, so Mt. Gox grew fast. By 2013 it handled about 70% of all bitcoin trades worldwide.

The technology and the company did not grow with it. Customers complained about withdrawals that took weeks, and the code behind the exchange had been written for a hobby site, not for one of the largest piles of digital money on the planet.

Timeline#

Where did the bitcoins go?#

At first Mt. Gox blamed a technical quirk of bitcoin called transaction malleability. Independent investigators told a less flattering story. In 2015 the Tokyo security firm WizSec concluded that most or all of the missing coins had been stolen straight out of the exchange's hot wallet, little by little, from late 2011 on – and that Mt. Gox did not notice for years because its own records did not match what was really in its wallets.

Think about that: an exchange can be robbed for over two years and still show every customer a healthy balance on the screen. The number in your account is just a line in the exchange's database. Whether the coins behind it exist is a different question.

US prosecutors later linked the stolen coins to Russian national Alexander Vinnik and the exchange BTC-e, which they said laundered them. Vinnik pleaded guilty in the USA in 2024 to a money-laundering conspiracy, and in February 2025 he was sent back to Russia in a prisoner swap. In 2023 the US also charged two other Russian nationals with the hack itself; they are accused, not convicted, and are believed to be in Russia.

Karpelès always denied stealing the coins. In 2019 a Tokyo court acquitted him of embezzlement but convicted him of manipulating electronic records to inflate the company's holdings, and gave him a suspended sentence.

Did the customers get their money back?#

Partly, and very slowly. Because bitcoin's price rose enormously while the case dragged on, the remaining coins became worth far more than the original claims. In 2018 a Japanese court switched the case from bankruptcy to civil rehabilitation, which allowed customers to be repaid in bitcoin instead of yen at 2014 prices.

The trustee had about 142,000 BTC to distribute. Repayments finally started in July 2024. By 2025 the trustee said base, early lump-sum and intermediate repayments were "largely completed" for creditors whose paperwork was in order. As of October 2026, the trustee still holds roughly 34,000–35,000 BTC for creditors who have not finished the process, and the official deadline is 31 October 2026. It had already been pushed back three times, so whether it will be extended again was still open when this lesson was written.

Most customers recovered only a fraction of the bitcoins they had in 2014 – but because bitcoin had become so much more valuable, many of them still ended up with more money than they lost in 2014 dollars. A strange happy ending that took a decade.

Warning signs you could have seen#

• Withdrawals that took weeks. When getting your money out becomes slow and full of excuses, the exchange may not have it. This is the oldest and most reliable warning sign in this whole course.
• One exchange holding most of the market. Size does not equal safety. Mt. Gox was the biggest – and the biggest target.
• No outside check of reserves. Nobody verified that the coins customers saw on screen really existed. Today some exchanges publish proof of reserves; it is not perfect, but it is better than nothing.
• Amateur operations. A hobby codebase, one key person and no audit is not how you guard hundreds of millions.
• Coins left on the exchange for years. Customers who withdrew to their own wallets lost nothing.

That is the idea behind self-custody. The course on safe custody walks you through it step by step, starting with exchange or your own wallet.

Common myths#

• "Mt. Gox was hacked in one big attack." According to investigators the coins drained out over years. The exchange simply did not notice.
• "The customers got nothing." They got a part, in bitcoin, starting in 2024 – very late, but not nothing.
• "That was the early days, it cannot happen now." The tools are better, but the core problem – trusting a company to hold your coins – is exactly the same, as FTX showed in 2022.

Sources#

• Mt. Gox rehabilitation trustee – official announcements (opens in a new tab)
• Decrypt – Mt. Gox pushes back repayments to October 2026 (2025) (opens in a new tab)
• Decrypt – Mt. Gox moves bitcoin as the repayment deadline looms (2026) (opens in a new tab)
• France 24 – Alexander Vinnik returns to Moscow after a prisoner swap (2025) (opens in a new tab)