Very good synopsis by Kevin. However, he has two technical mistakes in his post from a security perspective: 1) We don't know the attack vector. For example:

Very good synopsis by Kevin. However, he has two technical mistakes in his post from a security perspective: 1) We don't know the attack vector. For example: If Mt Gox has a SQL injection vulnerability, then a sophisticated attacker will not waste their time doing a rainbow attack on a random user. Instead, if the account balance is not encrypted and the key kept secret, then the attacker simply needs to do a SQL injection attack that returns the account with the largest balance: select top 1 t1.account_id, t1.balance from Account t1 order by t1.balance desc Instantly, the attacker knows the largest balance. This automatically reduces the attack space. This is a standard trick attackers use to bypass even needing to guess a password. 2) Compounding this issue, it seems Kevin is right, the attacked account had a naive password susceptible to a rainbow attack. According to rumors, this attack was a pooled account that mediated all the assets traded on the exchange. This implies that MtGox used a password susceptible to a rainbow attack to secure the master account. To answer Kevin's question, what user would amass $8M in bitcoins and use a bad password? The system administrators. 0xDEADBEEF. Postscript: I have never traded or owned bitcoins, or even signed up for an exchange. I just find the security breach fascinating!