6 ms·

Notable tidbits (most of which were already public record if you followed the story very closely) include: + Mt. Gox commingled depositor and corporate funds.

by patio11 11y ago

Notable tidbits (most of which were already public record if you followed the story very closely) include: + Mt. Gox commingled depositor and corporate funds. (Corroborated in the Japanese version of their docs released by the bankruptcy trustee.) Many in the community believed that they had promised not to do this (true) and they this was impressively unprincipled (I lean against this understanding). + Mt. Gox had standards of engineering professionalism which were not what one would hope would prevail at a financial institution with $500 million in assets. True and previously reported. Specific examples include lack of a staging environment, source control, testing procedure, engineering leadership, auditing... it goes on. Also might suggest in future not putting all code into MySQL. + At one point all BTC deposited at Gox were accessible by VNCing into a particular box, which suggests that claims that Gox had cold storage secured by keys kept in diverse physical locations were not consistent with conventional interpretations of engineering reality. (The new information here is "VNC." It was previously known that at one instant in time Gox proved its reserves by moving all it's BTC in a single transaction. This could be done in a way consistent with what the community thinks "cold storage" should mean; the VNC bit militates against that understanding.) + Employees of Mt. Gox believed, on the basic of public evidence, that the firm was losing money even at the peak. (I'd be interested in seeing their math for this; that was not the conclusion I reached in a napkin calculation in mid-2013.) + Wages at Tibbanne (which provided 100% of employees for Gox) were consistent with prevailing wages in Tokyo startups i.e. scandalously low. 50% of employees earned less than $2k per month; director-level salaries in order of $4k, except for... + ... explicitly alleged looting of customer funds to support director lifestyles. + Management was unable or unwilling to answer basic queries regarding finances internally. + Gox's bus number was one, and that bus would have resulted in $500 million being unrecoverablu lost. Management, when asked about this, lied brazenly. (Last part is new info, first part obvious.) There's more at the link.

oxide 11y ago
thanks for the highlights, I don't have time to dig through this properly at the moment and I haven't been following the story all that closely.
- patio11 11y ago
  You have made better life choices than I have.
  - toomuchtodo 11y ago
    While you jest, I can appreciate your interest in the topic and ongoing saga.
toomuchtodo 11y ago
Thanks for a detailed recap!
deleted 11y ago
[deleted]
- schneidmaster 11y ago
  That's what patio11 meant by the last bullet point ("Gox's bus number was one...").
astrange 11y ago
> + Wages at Tibbanne (which provided 100% of employees for Gox) were consistent with prevailing wages in Tokyo startups i.e. scandalously low. 50% of employees earned less than $2k per month; director-level salaries in order of $4k, except for... I've been told that employees at a certain like-deviantart-but-good startup are paid about as much as a convenience store worker. On the other hand, the conbini won't sponsor your visa.
- TazeTSchnitzel 11y ago
  > a certain like-deviantart-but-good startup Is this a thinly-veiled reference to pixiv?
- sandGorgon 11y ago
  that does not tell anything - are they employees in a different country ? Convenience store workers in the US earn about 20K USD per year - that is double the salary what a comp sci fresher from a tier 2 college (non-IIT) would earn in India. And that's a reasonable salary - at 10K USD per year, you can eat out everyday at pizza hut ("regular" food is cheaper), drink a couple of times a week and share a 3 bedroom apartment.
  - astrange 11y ago
    Compared to the convenience store next door to the office!
  - sdrothrock 11y ago
    The "deviant-art-like-but-good" bit is probably referring to pixiv, a popular Japanese art site. You're not going to live anywhere near a comfortable life in Tokyo on 2 million JPY a year, much less 1 million JPY a year. Convenience store workers here make around 950 yen/hr depending on what shift you're working on. Assuming you find somewhere super cheap and livable (we're talking slightly larger than a single bed, maybe not even including a bathroom) for 50000 yen/mo, that's already 600,000 yen/yr on housing alone. You can see that there's not much left over for utilities, food, transportation, clothes, medical, etc... and we're not even talking taxes and luxuries.
sethev 11y ago
You don't think it was unprincipled to commingle funds?
- deleted 11y ago
  [deleted]
- patio11 11y ago
  Not particularly. A deposit is a liability of the corporation; the cash on deposit is an asset. Where do people imagine these things typically exist? In the absence of legal requirements to the contrary, money is money -- it doesn't typically carry along requirements to physically segregate it by owner, intended purpose, etc. My company owes money to vendors, customers, and contractors, too, in the ordinary course of business. At any given time we have probably a few dozen creditors. How many deposit accounts do you think we have?
  - jbooth 11y ago
    I think, in the case of a bank or banking-like-entity, it's really easy to argue that commingling deposits with corporate funds makes it much more likely for things like.. what happened at mt gox to happen. If you violate professional standards while providing your services, even in the absence of requirements to the contrary, you're putting your clients at risk, probably to an unethical degree depending on what assurances you gave them.
  - grey-area 11y ago
    I don't think the comparison with an ordinary company is useful. They weren't mingling money paid to the company with money owed (which is normal), they were mingling client money, which they have no good reason to touch except under explicit instruction from the client, and their own funds used for operating expenses. Companies which explicitly hold other people's money are usually held to higher standards in holding it (Solicitors, Banks, Estate Agents, etc). For example deposits are usually held in a client account, separate from other corporate funds, and not usable except for the intended purpose. The reasons for this are obvious, as it makes fraud far harder to perpetrate, and Mt.Gox not doing so is a red flag given the business they were in. Even worse than this, this wasn't a corporate account, it was Mark's personal account! http://www.sra.org.uk/solicitors/handbook/accountsrules/part4/rule13/content.page http://www.sra.org.uk/solicitors/handbook/accountsrules/part... https://www.reddit.com/r/Bitcoin/comments/3fe92x/im_ashley_barr_aka_adam_turner_the_first_mtgox/ctnzun6 https://www.reddit.com/r/Bitcoin/comments/3fe92x/im_ashley_b...
austenallred 11y ago
Among the most notable of the tidbits I've seen: There was one bank account, shared by the CEO (personally) and MtGox itself.
- patio11 11y ago
  This is not correct, except to the extent that management appears to have routinely used Mt. Gox's corporate funds for purposes other than those reasonably required to run the corporation. Mizuho Bank, Shibuya Branch, No.1457705 was indeed registered in the name of Mt. Gox, as were several other accounts.
  - lars 11y ago
    https://www.reddit.com/r/Bitcoin/comments/3fe92x/im_ashley_barr_aka_adam_turner_the_first_mtgox/ctnzun6 https://www.reddit.com/r/Bitcoin/comments/3fe92x/im_ashley_b... > So you're saying that the mt gox bank account was his own personal account? I wired money to his personal account?? > Yes Maybe it wasn't correct in 2014, but apparently it was true when Barr worked there.
    - austenallred 11y ago
      Or at least he believed it was
weinzierl 11y ago
Thanks for this excellent easy to follow summary. The only piece I have difficulty to understand is this: The new information here is "VNC." It was previously known that at one instant in time Gox proved its reserves by moving all it's BTC in a single transaction. This could be done in a way consistent with what the community thinks "cold storage" should mean; the VNC bit militates against that understanding. What would be an example of "cold storage" that allows moving all BTC in a single transaction? And how does the fact that it is accessible via VNC change anything?
- mahyarm 11y ago
  Cold storage is storage of BTC private keys that are not connected to any live computer. Therefore anyone who would hack your live computer systems could not steal the cold storage BTC just by a remote hack. They would have to physically break into whatever location contained the keys, and then circumvent any encryption-in-rest that you had wrapping those private keys. You can also split up control of the keys with multisig, so multiple keys have to come together to move the BTC. Since most financial institutions only have small fraction of their balance needed to cover their money inflows and outflows, having most of your BTC in cold storage is a best practice.
- patio11 11y ago
  What would be an example of "cold storage" that allows moving all BTC in a single transaction? Have all the private keys stored on a machine which is airgapped. Sign a transaction on that machine; copy the transaction to a networked machine (could be done via e.g. copying a QR code from the monitor with a smartphone or, in extremis, just typing very carefully); release onto the Bitcoin network. And how does the fact that it is accessible via VNC change anything? Management has previously said that Gox's cold storage was based on offline copies of the keys being fixed onto paper and held in 3+ locations, sprinkled with some RAID-esque pixie dust. (I promise -- this is the maximally charitable summary.) If they're all available for management via VNC at any given time, that casts some doubt about whether they are actually striped over a bunch of paper wallets. Although the Bitcoin community is primarily worried about a server compromise followed instantly by a wallet draining, putting them on a machine accessible from the internal network is approximately just as dangerous, since one assumes that an attacker who gets the web server owns the entire internal network with probability approaching 1.
at-fates-hands 11y ago
>>> Specific examples include lack of a staging environment, source control, testing procedure, engineering leadership, auditing... it goes on. Also might suggest in future not putting all code into MySQL. This. . . is. . .particularly shocking. The FIRST thing I did when me and my two partners decided to start a business was to get all of these in place before we even started thinking of what we were going to build. All three of us thought it was that important. Dude, I mean, lack of source control? Who does that? Even when I only had two years of development experience it was drilled in my head this was not just optional, it was absolutely necessary - there is no option to the contrary. It was just basic stuff you should know and this guy was handling millions of dollars in transactions every day? It really makes my jaw drop to think about.
ar4s 11y ago
Hi, I'm Ashley Barr. (I'll prove it if necessary, but the tracks to this username have already been proved out by the bitcoin community) This is pretty vivid summary. I didn't actually know that most of what I provided was already in the public record. The reason I'm commenting is that I'm hoping to get more eyeballs on my original AMA, regarding Edit 3. Cheers for your insights, I learned a little too.

by patio11 11y ago

oxide 11y ago

thanks for the highlights, I don't have time to dig through this properly at the moment and I haven't been following the story all that closely.

patio11 11y ago
You have made better life choices than I have.
- toomuchtodo 11y ago
  While you jest, I can appreciate your interest in the topic and ongoing saga.

toomuchtodo 11y ago

Thanks for a detailed recap!

deleted 11y ago

[deleted]

schneidmaster 11y ago
That's what patio11 meant by the last bullet point ("Gox's bus number was one...").

astrange 11y ago

> + Wages at Tibbanne (which provided 100% of employees for Gox) were consistent with prevailing wages in Tokyo startups i.e. scandalously low. 50% of employees earned less than $2k per month; director-level salaries in order of $4k, except for... I've been told that employees at a certain like-deviantart-but-good startup are paid about as much as a convenience store worker. On the other hand, the conbini won't sponsor your visa.

TazeTSchnitzel 11y ago
> a certain like-deviantart-but-good startup Is this a thinly-veiled reference to pixiv?
sandGorgon 11y ago
that does not tell anything - are they employees in a different country ? Convenience store workers in the US earn about 20K USD per year - that is double the salary what a comp sci fresher from a tier 2 college (non-IIT) would earn in India. And that's a reasonable salary - at 10K USD per year, you can eat out everyday at pizza hut ("regular" food is cheaper), drink a couple of times a week and share a 3 bedroom apartment.
- astrange 11y ago
  Compared to the convenience store next door to the office!
- sdrothrock 11y ago
  The "deviant-art-like-but-good" bit is probably referring to pixiv, a popular Japanese art site. You're not going to live anywhere near a comfortable life in Tokyo on 2 million JPY a year, much less 1 million JPY a year. Convenience store workers here make around 950 yen/hr depending on what shift you're working on. Assuming you find somewhere super cheap and livable (we're talking slightly larger than a single bed, maybe not even including a bathroom) for 50000 yen/mo, that's already 600,000 yen/yr on housing alone. You can see that there's not much left over for utilities, food, transportation, clothes, medical, etc... and we're not even talking taxes and luxuries.

sethev 11y ago

You don't think it was unprincipled to commingle funds?

deleted 11y ago
[deleted]
patio11 11y ago
Not particularly. A deposit is a liability of the corporation; the cash on deposit is an asset. Where do people imagine these things typically exist? In the absence of legal requirements to the contrary, money is money -- it doesn't typically carry along requirements to physically segregate it by owner, intended purpose, etc. My company owes money to vendors, customers, and contractors, too, in the ordinary course of business. At any given time we have probably a few dozen creditors. How many deposit accounts do you think we have?
- jbooth 11y ago
  I think, in the case of a bank or banking-like-entity, it's really easy to argue that commingling deposits with corporate funds makes it much more likely for things like.. what happened at mt gox to happen. If you violate professional standards while providing your services, even in the absence of requirements to the contrary, you're putting your clients at risk, probably to an unethical degree depending on what assurances you gave them.
- grey-area 11y ago
  I don't think the comparison with an ordinary company is useful. They weren't mingling money paid to the company with money owed (which is normal), they were mingling client money, which they have no good reason to touch except under explicit instruction from the client, and their own funds used for operating expenses. Companies which explicitly hold other people's money are usually held to higher standards in holding it (Solicitors, Banks, Estate Agents, etc). For example deposits are usually held in a client account, separate from other corporate funds, and not usable except for the intended purpose. The reasons for this are obvious, as it makes fraud far harder to perpetrate, and Mt.Gox not doing so is a red flag given the business they were in. Even worse than this, this wasn't a corporate account, it was Mark's personal account! http://www.sra.org.uk/solicitors/handbook/accountsrules/part4/rule13/content.page http://www.sra.org.uk/solicitors/handbook/accountsrules/part... https://www.reddit.com/r/Bitcoin/comments/3fe92x/im_ashley_barr_aka_adam_turner_the_first_mtgox/ctnzun6 https://www.reddit.com/r/Bitcoin/comments/3fe92x/im_ashley_b...

austenallred 11y ago

Among the most notable of the tidbits I've seen: There was one bank account, shared by the CEO (personally) and MtGox itself.

patio11 11y ago
This is not correct, except to the extent that management appears to have routinely used Mt. Gox's corporate funds for purposes other than those reasonably required to run the corporation. Mizuho Bank, Shibuya Branch, No.1457705 was indeed registered in the name of Mt. Gox, as were several other accounts.
- lars 11y ago
  https://www.reddit.com/r/Bitcoin/comments/3fe92x/im_ashley_barr_aka_adam_turner_the_first_mtgox/ctnzun6 https://www.reddit.com/r/Bitcoin/comments/3fe92x/im_ashley_b... > So you're saying that the mt gox bank account was his own personal account? I wired money to his personal account?? > Yes Maybe it wasn't correct in 2014, but apparently it was true when Barr worked there.
  - austenallred 11y ago
    Or at least he believed it was

weinzierl 11y ago

Thanks for this excellent easy to follow summary. The only piece I have difficulty to understand is this: The new information here is "VNC." It was previously known that at one instant in time Gox proved its reserves by moving all it's BTC in a single transaction. This could be done in a way consistent with what the community thinks "cold storage" should mean; the VNC bit militates against that understanding. What would be an example of "cold storage" that allows moving all BTC in a single transaction? And how does the fact that it is accessible via VNC change anything?

mahyarm 11y ago
Cold storage is storage of BTC private keys that are not connected to any live computer. Therefore anyone who would hack your live computer systems could not steal the cold storage BTC just by a remote hack. They would have to physically break into whatever location contained the keys, and then circumvent any encryption-in-rest that you had wrapping those private keys. You can also split up control of the keys with multisig, so multiple keys have to come together to move the BTC. Since most financial institutions only have small fraction of their balance needed to cover their money inflows and outflows, having most of your BTC in cold storage is a best practice.
patio11 11y ago
What would be an example of "cold storage" that allows moving all BTC in a single transaction? Have all the private keys stored on a machine which is airgapped. Sign a transaction on that machine; copy the transaction to a networked machine (could be done via e.g. copying a QR code from the monitor with a smartphone or, in extremis, just typing very carefully); release onto the Bitcoin network. And how does the fact that it is accessible via VNC change anything? Management has previously said that Gox's cold storage was based on offline copies of the keys being fixed onto paper and held in 3+ locations, sprinkled with some RAID-esque pixie dust. (I promise -- this is the maximally charitable summary.) If they're all available for management via VNC at any given time, that casts some doubt about whether they are actually striped over a bunch of paper wallets. Although the Bitcoin community is primarily worried about a server compromise followed instantly by a wallet draining, putting them on a machine accessible from the internal network is approximately just as dangerous, since one assumes that an attacker who gets the web server owns the entire internal network with probability approaching 1.

at-fates-hands 11y ago

>>> Specific examples include lack of a staging environment, source control, testing procedure, engineering leadership, auditing... it goes on. Also might suggest in future not putting all code into MySQL. This. . . is. . .particularly shocking. The FIRST thing I did when me and my two partners decided to start a business was to get all of these in place before we even started thinking of what we were going to build. All three of us thought it was that important. Dude, I mean, lack of source control? Who does that? Even when I only had two years of development experience it was drilled in my head this was not just optional, it was absolutely necessary - there is no option to the contrary. It was just basic stuff you should know and this guy was handling millions of dollars in transactions every day? It really makes my jaw drop to think about.

ar4s 11y ago

Hi, I'm Ashley Barr. (I'll prove it if necessary, but the tracks to this username have already been proved out by the bitcoin community) This is pretty vivid summary. I didn't actually know that most of what I provided was already in the public record. The reason I'm commenting is that I'm hoping to get more eyeballs on my original AMA, regarding Edit 3. Cheers for your insights, I learned a little too.