9 ms·

Fraud caused disappearance of 99% of Mt. Gox Bitcoins

148 points by jpatokal 12y ago

drcode 12y ago
From all the theories I've seen, the most likely to me is that this was a business that slowly drifted into a whirlpool of fraud and insolvency, probably starting with good intentions. Most likely, they had a hard time maintaining the right ratio of bitcoin/yen/USD to match the reality of their customer's deposits (through incompetency) and got hit hard when the "wrong" price fluctuations occurred... when this happened, and in which direction the fluctuation happened, I cannot say. After that, they were deeply into a fractional reserve situation and thought "hey, we own a large part of the Bitcoin market, we can probably play the price a bit to make our customers whole again, without anyone knowing what had happened." In this way, they gradually drifted from "cutting corners and doing the ugly things required to keep a business afloat" (aka mild, veiled fraud) into outright fraud.
- Pyxl101 12y ago
  Your theory seems reasonable to me, and I know you're not defending them, but ... How difficult is it to keep the right amount of bitcoin and USD in deposit? It seems pretty simple to me. Customer deposits $1.00, then I keep $1.00 in deposit in my business account. Customer deposits 1 bitcoin, I keep one bitcoin. The account for customer deposits will only ever be touched by automated systems processing these transactions. If I'm charging fees as part of depositing/withdrawing/trading currencies or BTC, then those fees are immediately swept into a separate account, the entirety of which is revenue. Kept strictly separate from deposits. I'd regularly audit both accounts to confirm that the dollar amounts of each deposit/withdrawal, as well as total, match the records of actions in my systems. Mt Gox only ever handled about 40 trades per second. Seems like you could keep everything balanced with a typical database, using transactions to implement atomic trades / deposits / withdrawals. Perhaps interfacing with money transmission systems is slightly more difficult, but once a transaction has reached the point of having probably-completed, you initiate the transaction to modify the customer's balance of bitcoin and currency. So I guess I'm agreeing with you that if they failed in this way, they must have been incompetent. P.S. I'm just making all this up. I've never worked in payments or accounting. I expect a good security or finance auditor could suggest much better controls. I'd pick up an "accounting for dummies" book and learn about the basic control principles used in accounting to prevent fraud. Perhaps I periodically download statements from my bank, print them out (or receive them in the mail) and audit those records against my own systems, by hand. Do the same electronically on a continuous basis. Set up an off-site write-only logging system to capture all transactions, and regularly audit to ensure that the system logs match bank transaction logs.
  - drcode 12y ago
    This is just wild speculation now... ...but my best guess is their trading engine was so unstable that they ended up using one server to run a stripped-down clearance house algorithm for executing the trades as quickly as feasible, and a separate system that was the "source of truth" for how many physical assets in bitcoin/yen/USD were actually in possession by the company. I'm guessing that there was absolutely nothing "atomic" about the system Marc Karpeles had built, their storage system was just an amalgam of disconnected, duct-taped databases living in different places, that were "kinda, sorta" in sync with each other, with lots of unpredictable, undefined behavior.
  - wmf 12y ago
    MtGox was pretty buggy and many of those bugs lost money, which could easily make them insolvent. Also, interfacing with Bitcoin at scale (e.g. managing thousands of addresses) required a lot of custom programming.
  - drcode 12y ago
    > I'd set up a write-only logging system to be used for auditing company systems I bet Marc Karpeles had 5 people calling him at once that the trading engine was down again so THAT's where he put is efforts... He didn't get any calls from people saying "By the way, I hope you have robust auditing procedures." Like some people live paycheck to paycheck, I'm betting the MtGox guys were living from critical bug report to critical bug report, without time for "luxuries" like "atomicity" or "database auditing" (Let me say up front I am in no way intending for my comments to be a defense of the behavior of these criminals.)
    - patio11 12y ago
      It has been credibly alleged [+] that Mt. Gox's general level of engineering acumen can be summed up as "No tests, no staging environment, live coding by SSHing into production." [+] Unnamed employee of Tibanne, the parent company which supplied substantially all of 0-employee Mt. Gox's staffing: http://www.pcworld.com/article/2105920/lost-in-translation-the-tangled-tale-of-mt-goxs-missing-millions.html http://www.pcworld.com/article/2105920/lost-in-translation-t...
- jostmey 12y ago
  The line between legitimate business and an illegal operation can be as thin as the line between genius and insanity.
- schuman 12y ago
  For fucks sake, MtGox did not drift into 'fractional reserve' it became insolvent. There's an important difference, and you're smart enough to know it.
- tim333 12y ago
  An alternative explanation could be that Karpeles, who was convicted of fraud in 2010, decided to stick with the fraud thing from the start.
- rtpg 12y ago
  Here's the thing I don't get. By default, you're receiving bitcoin and sending out dollars/yen. By default, there should be no discrepancies! I feel like you would need to be actively incompetent and trying to do tricky things for this to go out of sync. If I had a box, accepted apples and oranges, and would give them back to the owner if asked(taking some slices as payment fees, but at transaction) , at what point can things disappear? The only thing I can think of is race condition style things, but that's a single point of failure right? Maybe I'm missing some complexity here
- JoeAltmaier 12y ago
  SO not a surprise that an unregulated exchange of securities was mismanaged and collapsed. Explain to me again how Bitcoin is supposed to work? Because from the outside it looks like an electronic Ponzi scheme.
  - knowaveragejoe 12y ago
    I'm skeptical of bitcoin's success as well, but for different reasons. I am however totally confident in the technology itself, and it doesn't really play much of a factor in this story as far as I can tell. It kinda sounds like you're conflating bitcoin exchanges with the technology itself.
    - JoeAltmaier 12y ago
      Nothing to do with technology. Has to do with arrogant developer with no experience with financial regulation, thinking they can just ignore centuries of safeguards because they know math.
patio11 12y ago
I'll try to find a print copy when the Yomiuri hits news stands on the 3rd and post the gist of it, but don't get your hopes up on this shedding a lot of light on the story.
- sillysaurus3 12y ago
  Please, and thank you! I've been avidly following every piece of news about Mt. Gox, so it would be great to hear a translation of the news story. It probably won't have any new details, but I'm very interested to know how Japan feels about the situation. A translation of a printed story might not be the best way to find that out, but at least it's something.
- DCoder 12y ago
  Reddit seems to have some info from the print edition already: https://www.reddit.com/r/Bitcoin/comments/2qyyy9/tokyo_metro_police_fraud_causes_disappearance_of/cnay4w5 https://www.reddit.com/r/Bitcoin/comments/2qyyy9/tokyo_metro...
butwhy 12y ago
This is still a mystery? I thought it was widely accepted that Karpeles stole the money for himself to buy Starbucks.
deleted 12y ago
[deleted]
bigbugbag 12y ago
Well this could be interesting if it's more than hype to sell more paper. Karpelès having quite a trail of fraud and misconduct, I'm curious to learn the results of the Magic The Gathering Online Exchange investigation. For those who don't know yet about the past of Karpelès, he started his career when over a disagreement with his employer he moved some of the company's clients' data over to his own servers, redirected a company domain towards one of his then resigned from the company. When the company confronted him, he refused to give back what he took and offered to buy the domain he stole, so the company went to court with Karpelès admitting he did it to the police but telling a different story on his blog [1]. With Karpelès not appearing at the audience because he had left the country he got sentenced in 2010 to 1 year of prison and 45 000€ in damage [2]. This is only part of a trail of lies, deception and fraud from Karpalès for his personal profit that has started to surface, we know have a blog he made in 2006 where he confessed of getting caught for a youth error of doing bad things with online payment systems for 2 years[3] or how he used lies to get money for a job he didn't do[4]. Of course that doesn't mean he did stole the coins, that's why I want to know about the investigation. [1]: https://web.archive.org/web/20070630213730/http://www.magicaltux.net/blog/2006/11/23/105-le-point-sur-2006-eurocenter-portha-ff-st-etc https://web.archive.org/web/20070630213730/http://www.magica... [2]: https://www.documentcloud.org/documents/1238981-img-20140720-0001.html https://www.documentcloud.org/documents/1238981-img-20140720... [3]: http://web.archive.org/web/20140302234940/http://blog.magicaltux.net/2006/02/12/pensees-nocturnes/ http://web.archive.org/web/20140302234940/http://blog.magica... [4]: https://www.cryptocoinsnews.com/exclusive-tibanne-co-ltd-sentenced-2013-mark-karpeless-lies-new/ https://www.cryptocoinsnews.com/exclusive-tibanne-co-ltd-sen...
- btown 12y ago
  It's astonishing that financially minded people, used to doing due diligence for potential investments in their day jobs, would trust a company with their own personal money without digging into its founder's backstory!
  - gwern 12y ago
    Most (all?) of that material was in French, which seems to have been a surprisingly effective barrier. (French proficiency is not terribly common in the US or Japan; and how many people are so paranoid about random counterparties that they will hire translators to go through everything any of the counterparties have ever written looking for red flags? Have you ever done that?) I don't recall even the Mtgox haters bringing up any of the French backstory until not long before the end.
jnaglick 12y ago
It's almost like people with no education or training and a history filled with criminal activity can't be trusted to run financial institutions. It's almost like there is a great irony in the fact that people who mistrusted government run banks sought an anonymous unregulated cryptocurrency and then immediately got ripped off because it's anonymous and unregulated.
- sparkie 12y ago
  > government run banks What's one of these? It's the other way round - banks run governments.
  - mercurial 12y ago
    Should probably be read as government-regulated instead. For some value of "regulated", anyway.
- Eleopteryx 12y ago
  Is that to suggest that regulated banks (or any kind of government-regulated institutions) don't ever rip people off or otherwise engage in criminal or fraudulent activity? Or is your point that this type of corruption is innate to any system involving humans? I for one am just interested in its potential as a technology foremost; this isn't about mistrust of the government for me.

148 points by jpatokal 12y ago

From all the theories I've seen, the most likely to me is that this was a business that slowly drifted into a whirlpool of fraud and insolvency, probably starting with good intentions. Most likely, they had a hard time maintaining the right ratio of bitcoin/yen/USD to match the reality of their customer's deposits (through incompetency) and got hit hard when the "wrong" price fluctuations occurred... when this happened, and in which direction the fluctuation happened, I cannot say. After that, they were deeply into a fractional reserve situation and thought "hey, we own a large part of the Bitcoin market, we can probably play the price a bit to make our customers whole again, without anyone knowing what had happened." In this way, they gradually drifted from "cutting corners and doing the ugly things required to keep a business afloat" (aka mild, veiled fraud) into outright fraud.

Pyxl101 12y ago
Your theory seems reasonable to me, and I know you're not defending them, but ... How difficult is it to keep the right amount of bitcoin and USD in deposit? It seems pretty simple to me. Customer deposits $1.00, then I keep $1.00 in deposit in my business account. Customer deposits 1 bitcoin, I keep one bitcoin. The account for customer deposits will only ever be touched by automated systems processing these transactions. If I'm charging fees as part of depositing/withdrawing/trading currencies or BTC, then those fees are immediately swept into a separate account, the entirety of which is revenue. Kept strictly separate from deposits. I'd regularly audit both accounts to confirm that the dollar amounts of each deposit/withdrawal, as well as total, match the records of actions in my systems. Mt Gox only ever handled about 40 trades per second. Seems like you could keep everything balanced with a typical database, using transactions to implement atomic trades / deposits / withdrawals. Perhaps interfacing with money transmission systems is slightly more difficult, but once a transaction has reached the point of having probably-completed, you initiate the transaction to modify the customer's balance of bitcoin and currency. So I guess I'm agreeing with you that if they failed in this way, they must have been incompetent. P.S. I'm just making all this up. I've never worked in payments or accounting. I expect a good security or finance auditor could suggest much better controls. I'd pick up an "accounting for dummies" book and learn about the basic control principles used in accounting to prevent fraud. Perhaps I periodically download statements from my bank, print them out (or receive them in the mail) and audit those records against my own systems, by hand. Do the same electronically on a continuous basis. Set up an off-site write-only logging system to capture all transactions, and regularly audit to ensure that the system logs match bank transaction logs.
- drcode 12y ago
  This is just wild speculation now... ...but my best guess is their trading engine was so unstable that they ended up using one server to run a stripped-down clearance house algorithm for executing the trades as quickly as feasible, and a separate system that was the "source of truth" for how many physical assets in bitcoin/yen/USD were actually in possession by the company. I'm guessing that there was absolutely nothing "atomic" about the system Marc Karpeles had built, their storage system was just an amalgam of disconnected, duct-taped databases living in different places, that were "kinda, sorta" in sync with each other, with lots of unpredictable, undefined behavior.
- wmf 12y ago
  MtGox was pretty buggy and many of those bugs lost money, which could easily make them insolvent. Also, interfacing with Bitcoin at scale (e.g. managing thousands of addresses) required a lot of custom programming.
- drcode 12y ago
  > I'd set up a write-only logging system to be used for auditing company systems I bet Marc Karpeles had 5 people calling him at once that the trading engine was down again so THAT's where he put is efforts... He didn't get any calls from people saying "By the way, I hope you have robust auditing procedures." Like some people live paycheck to paycheck, I'm betting the MtGox guys were living from critical bug report to critical bug report, without time for "luxuries" like "atomicity" or "database auditing" (Let me say up front I am in no way intending for my comments to be a defense of the behavior of these criminals.)
  - patio11 12y ago
    It has been credibly alleged [+] that Mt. Gox's general level of engineering acumen can be summed up as "No tests, no staging environment, live coding by SSHing into production." [+] Unnamed employee of Tibanne, the parent company which supplied substantially all of 0-employee Mt. Gox's staffing: http://www.pcworld.com/article/2105920/lost-in-translation-the-tangled-tale-of-mt-goxs-missing-millions.html http://www.pcworld.com/article/2105920/lost-in-translation-t...
jostmey 12y ago
The line between legitimate business and an illegal operation can be as thin as the line between genius and insanity.
schuman 12y ago
For fucks sake, MtGox did not drift into 'fractional reserve' it became insolvent. There's an important difference, and you're smart enough to know it.
tim333 12y ago
An alternative explanation could be that Karpeles, who was convicted of fraud in 2010, decided to stick with the fraud thing from the start.
rtpg 12y ago
Here's the thing I don't get. By default, you're receiving bitcoin and sending out dollars/yen. By default, there should be no discrepancies! I feel like you would need to be actively incompetent and trying to do tricky things for this to go out of sync. If I had a box, accepted apples and oranges, and would give them back to the owner if asked(taking some slices as payment fees, but at transaction) , at what point can things disappear? The only thing I can think of is race condition style things, but that's a single point of failure right? Maybe I'm missing some complexity here
JoeAltmaier 12y ago
SO not a surprise that an unregulated exchange of securities was mismanaged and collapsed. Explain to me again how Bitcoin is supposed to work? Because from the outside it looks like an electronic Ponzi scheme.
- knowaveragejoe 12y ago
  I'm skeptical of bitcoin's success as well, but for different reasons. I am however totally confident in the technology itself, and it doesn't really play much of a factor in this story as far as I can tell. It kinda sounds like you're conflating bitcoin exchanges with the technology itself.
  - JoeAltmaier 12y ago
    Nothing to do with technology. Has to do with arrogant developer with no experience with financial regulation, thinking they can just ignore centuries of safeguards because they know math.

patio11 12y ago

I'll try to find a print copy when the Yomiuri hits news stands on the 3rd and post the gist of it, but don't get your hopes up on this shedding a lot of light on the story.

sillysaurus3 12y ago
Please, and thank you! I've been avidly following every piece of news about Mt. Gox, so it would be great to hear a translation of the news story. It probably won't have any new details, but I'm very interested to know how Japan feels about the situation. A translation of a printed story might not be the best way to find that out, but at least it's something.
DCoder 12y ago
Reddit seems to have some info from the print edition already: https://www.reddit.com/r/Bitcoin/comments/2qyyy9/tokyo_metro_police_fraud_causes_disappearance_of/cnay4w5 https://www.reddit.com/r/Bitcoin/comments/2qyyy9/tokyo_metro...

butwhy 12y ago

This is still a mystery? I thought it was widely accepted that Karpeles stole the money for himself to buy Starbucks.

deleted 12y ago

[deleted]

bigbugbag 12y ago

Well this could be interesting if it's more than hype to sell more paper. Karpelès having quite a trail of fraud and misconduct, I'm curious to learn the results of the Magic The Gathering Online Exchange investigation. For those who don't know yet about the past of Karpelès, he started his career when over a disagreement with his employer he moved some of the company's clients' data over to his own servers, redirected a company domain towards one of his then resigned from the company. When the company confronted him, he refused to give back what he took and offered to buy the domain he stole, so the company went to court with Karpelès admitting he did it to the police but telling a different story on his blog [1]. With Karpelès not appearing at the audience because he had left the country he got sentenced in 2010 to 1 year of prison and 45 000€ in damage [2]. This is only part of a trail of lies, deception and fraud from Karpalès for his personal profit that has started to surface, we know have a blog he made in 2006 where he confessed of getting caught for a youth error of doing bad things with online payment systems for 2 years[3] or how he used lies to get money for a job he didn't do[4]. Of course that doesn't mean he did stole the coins, that's why I want to know about the investigation. [1]: https://web.archive.org/web/20070630213730/http://www.magicaltux.net/blog/2006/11/23/105-le-point-sur-2006-eurocenter-portha-ff-st-etc https://web.archive.org/web/20070630213730/http://www.magica... [2]: https://www.documentcloud.org/documents/1238981-img-20140720-0001.html https://www.documentcloud.org/documents/1238981-img-20140720... [3]: http://web.archive.org/web/20140302234940/http://blog.magicaltux.net/2006/02/12/pensees-nocturnes/ http://web.archive.org/web/20140302234940/http://blog.magica... [4]: https://www.cryptocoinsnews.com/exclusive-tibanne-co-ltd-sentenced-2013-mark-karpeless-lies-new/ https://www.cryptocoinsnews.com/exclusive-tibanne-co-ltd-sen...

btown 12y ago
It's astonishing that financially minded people, used to doing due diligence for potential investments in their day jobs, would trust a company with their own personal money without digging into its founder's backstory!
- gwern 12y ago
  Most (all?) of that material was in French, which seems to have been a surprisingly effective barrier. (French proficiency is not terribly common in the US or Japan; and how many people are so paranoid about random counterparties that they will hire translators to go through everything any of the counterparties have ever written looking for red flags? Have you ever done that?) I don't recall even the Mtgox haters bringing up any of the French backstory until not long before the end.

jnaglick 12y ago

It's almost like people with no education or training and a history filled with criminal activity can't be trusted to run financial institutions. It's almost like there is a great irony in the fact that people who mistrusted government run banks sought an anonymous unregulated cryptocurrency and then immediately got ripped off because it's anonymous and unregulated.

sparkie 12y ago
> government run banks What's one of these? It's the other way round - banks run governments.
- mercurial 12y ago
  Should probably be read as government-regulated instead. For some value of "regulated", anyway.
Eleopteryx 12y ago
Is that to suggest that regulated banks (or any kind of government-regulated institutions) don't ever rip people off or otherwise engage in criminal or fraudulent activity? Or is your point that this type of corruption is innate to any system involving humans? I for one am just interested in its potential as a technology foremost; this isn't about mistrust of the government for me.