← back to the index
VT-008 Crypto exchange · Japan 2014

Mt. Gox — The Exchange That Lost 850,000 Bitcoin and Defined an Era

trading-exchangeconvictedpioneer
Platform
Mt. Gox
Est. Losses
~850,000 BTC (~$460M in 2014; ~$7B+ at 2021 peak)
Users Affected
~127,000 creditors
Status
Convicted

Summary

Mt. Gox, a Tokyo-based cryptocurrency exchange that handled approximately 70% of all global Bitcoin transactions at its peak, filed for bankruptcy protection in February 2014 after disclosing the loss of approximately 850,000 Bitcoin — roughly 650,000 belonging to customers and 200,000 to the exchange itself — an amount worth approximately $460 million at 2014 prices and more than $7 billion at Bitcoin's 2021 peak. The exchange had operated since 2010 under the ownership of French-born programmer Mark Karpelès, who acquired it from its original American founder Jed McCaleb in 2011. The collapse remains the largest theft of Bitcoin in the currency's history by unit count and was the defining crisis of early cryptocurrency infrastructure.

Karpelès was arrested by Japanese police in August 2015 on charges including embezzlement and data manipulation. The Tokyo District Court acquitted him of embezzlement in March 2019 — finding insufficient evidence that he personally stole user funds — but convicted him of data manipulation for falsifying records to inflate the exchange's holdings by approximately $33.5 million. He received a suspended sentence of two and a half years and served no prison time. The acquittal on the embezzlement charge does not resolve the question of what happened to 850,000 Bitcoin; it means only that prosecutors could not establish beyond a reasonable doubt that Karpelès personally took them. The Tokyo High Court upheld the conviction on appeal in 2020.

The recovery process has extended for more than a decade. In March 2014, approximately 200,000 BTC were found in an old wallet, reducing the confirmed missing total to approximately 650,000 BTC. Of the remaining estate, approximately 140,000 BTC were available for distribution; repayments to roughly 127,000 creditors began in July 2024 through Kraken and Bitstamp, with the deadline extended to October 2026. Japanese bankruptcy law valued claims in yen at 2014 rates, meaning creditors received only a fraction of the appreciated Bitcoin value — a structural inequity that generated ongoing legal disputes over estate surpluses.

Timeline

July 2010
Mt. Gox founded
Jed McCaleb launches Mt. Gox as a trading platform for Magic: The Gathering cards, repurposes it as a Bitcoin exchange. By late 2010 it is processing the majority of global Bitcoin trades.
March 2011
Karpelès acquires exchange
Mark Karpelès purchases Mt. Gox from McCaleb for approximately 50,000 BTC plus a share of future profits; Tibanne Co., Ltd. becomes the operating entity in Tokyo.
June 2011
First major security incident
Approximately 2,643 BTC are stolen after an attacker gains access to an auditor's computer and creates a fraudulent transaction driving prices briefly to near-zero on the platform.
2012–2013
Growth to dominance
Mt. Gox accounts for approximately 70% of all global Bitcoin trading volume; it becomes the de facto price-setting venue for the asset globally. Infrastructure lags badly behind volume.
February 7, 2014
Withdrawals halted
Mt. Gox suspends all Bitcoin withdrawals, citing what it describes as "transaction malleability" — a known but rarely exploited Bitcoin protocol quirk — as the cause of unspecified losses.
February 24, 2014
Exchange goes dark
Mt. Gox's website is taken offline. An internal document — the "Crisis Strategy Draft" — is leaked online, disclosing the loss of approximately 744,408 BTC.
February 28, 2014
Bankruptcy filing
Karpelès files for civil rehabilitation in Tokyo, disclosing the loss of approximately 850,000 BTC, estimated at $473 million at prevailing prices, to the Tokyo District Court.
March 2014
200,000 BTC found
Mt. Gox discloses the discovery of approximately 200,000 BTC in a cold wallet that had not been included in the bankruptcy disclosure, reducing the confirmed missing amount to approximately 650,000 BTC.
August 2015
Karpelès arrested
Japanese police arrest Karpelès on charges of embezzlement and data manipulation relating to his management of Mt. Gox.
March 14, 2019
Trial verdict
The Tokyo District Court acquits Karpelès of embezzlement but convicts him of data manipulation for falsifying exchange records to inflate holdings by approximately $33.5M. He receives a suspended 2.5-year sentence.
2020
Conviction upheld
The Tokyo High Court upholds Karpelès's data manipulation conviction on appeal; he serves no prison time.
July 2024
Creditor repayments begin
The bankruptcy trustee begins distributing approximately 140,000 BTC and equivalent Bitcoin Cash to creditors via Kraken and Bitstamp; the process is confirmed by multiple creditors. Deadline subsequently extended to October 2026.

The Exchange That Became Bitcoin's Market

Mt. Gox's name was an acronym for "Magic: The Gathering Online eXchange" — Jed McCaleb's original trading card concept, repurposed as Bitcoin exchange in 2010. First-mover advantage in a market with no competitors gave it near-total dominance by 2011, when Karpelès acquired it. The exchange was not designed for that role; it arrived there through timing and the absence of alternatives.

Karpelès was a competent programmer but ill-suited to the operational and security demands of a custodial institution at scale. Court testimony and internal records described infrastructure perpetually inadequate for transaction volume, security practices years behind the threat environment, and account records that did not reliably reconcile on-chain holdings against customer liabilities.

A June 2011 hack — in which an attacker accessed an auditor's credentials and briefly manipulated prices — should have been an inflection point for security investment. It was not. Cold storage practices were never formalized, no major external audit of holdings was conducted, and a 2011 regulatory submission was never completed. The exchange remained structurally exposed for the entirety of its subsequent operation.

How 850,000 Bitcoin Disappeared

The mechanism of the Mt. Gox loss is still not entirely established in the public record, and this ambiguity was central to Karpelès's acquittal on the embezzlement charge. The prosecution's theory was that Karpelès used his administrative access to the exchange to inflate his personal account balance and withdraw funds for personal use. The defense's position was that the losses resulted from a long-running external hack made possible by severe security negligence.

The transaction malleability claim — Karpelès's explanation for the February 2014 withdrawal freeze — described a real, known Bitcoin protocol vulnerability that allows a transaction's unique identifier to be altered before confirmation. Bitcoin developers considered it a minor nuisance; exploiting it at the scale of hundreds of thousands of Bitcoin would require sustained internal system access. The claim served mainly as a technically plausible delay while the exchange's true position remained concealed.

Japanese investigators and independent blockchain analysts concluded that the losses resulted from a sustained, multi-year draining of Mt. Gox's hot wallets beginning as early as 2011. The 850,000 BTC figure was not a single incident but the cumulative product of losses masked by accounting that never reconciled on-chain holdings against customer liabilities. The March 2014 discovery of 200,000 BTC in an overlooked old wallet — reducing the missing total to approximately 650,000 BTC — was itself a symptom of record-keeping so poor that significant balances had been mislabeled for years. Whether further unidentified wallets exist has never been definitively resolved.

The Trial: What Karpelès Was and Was Not Convicted Of

The distinction between Karpelès's conviction and his acquittal is critical to understanding the Mt. Gox case and is frequently misrepresented.

Karpelès was convicted of data manipulation: he falsified Mt. Gox's system records to inflate the exchange's reported Bitcoin holdings by approximately $33.5 million. The Tokyo District Court sentenced him to two years and six months, suspended for four years — probation without incarceration. The Tokyo High Court upheld the verdict on appeal in 2020.

He was acquitted of embezzlement. The court found prosecutors had not established beyond a reasonable doubt that he personally misappropriated customer Bitcoin. This acquittal does not establish that no theft occurred; it establishes only that the specific charge of personal misappropriation was not proven to the criminal standard. The 650,000 BTC that remained unaccounted for after the bankruptcy filing were never located, and no alternative explanation for their disappearance was established at trial.

The data manipulation conviction is the more analytically significant finding. It confirmed that Karpelès actively falsified the records users and creditors relied on — meaning the information asymmetry between operator and depositor was not merely a product of poor accounting but of deliberate misrepresentation. Users had no means of detecting the shortfall because the books they might have referenced were wrong by design.

The Five Factors

01
Infrastructure failure at foundational scale
Mt. Gox became the world's dominant Bitcoin exchange without building security infrastructure commensurate with that role. Hot wallet management, transaction reconciliation, and cold storage practices were all inadequate. The sustained multi-year drain was not a sophisticated adversary defeating a sophisticated defense; it was a basic failure to invest in the protections custodians require.
02
The proof-of-reserves gap at the ecosystem level
In 2014 no mechanism — technical or regulatory — required exchanges to demonstrate on-chain holdings matched customer liabilities. Mt. Gox's internal records were manipulated. Users had no independent means of verification. The 850,000 BTC gap accumulated for years precisely because no external attestation was ever demanded or provided.
03
Regulatory non-registration in a major financial jurisdiction
Mt. Gox operated in Japan without registration as a financial institution, so no capital adequacy requirements, audit obligations, or mandatory incident reporting applied. Japan enacted exchange licensing requirements in 2017 directly in response to this collapse. The absence of those requirements was a necessary enabling condition.
04
Systemic concentration in a single custodian
At its peak, Mt. Gox processed approximately 70% of global Bitcoin volume — a single entity with a single point of failure holding custody over the majority of the world's Bitcoin trades. Custodial concentration of that magnitude converts an individual operator failure into a market infrastructure failure.
05
Technical complexity as disclosure shield
The transaction malleability explanation introduced enough genuine technical nuance to delay credible external analysis while the exchange's true position remained hidden. Superficially plausible technical narratives are a documented feature of fraudulent and negligent disclosures; they exploit the information asymmetry between operators and depositors and buy time that victims cannot afford.

Aftermath

Mark Karpelès was convicted of data manipulation in March 2019 and sentenced to a suspended two-and-a-half-year term; the Tokyo High Court upheld the conviction on appeal in 2020. He served no prison time and has not faced additional criminal charges as of mid-2026.

The civil rehabilitation estate was administered by trustee Nobuaki Kobayashi from 2014 through 2024. In July 2024, distributions of approximately 140,000 BTC and equivalent Bitcoin Cash began flowing to approximately 127,000 creditors via Kraken and Bitstamp; by March 2025 roughly 19,500 creditors had confirmed receipt. The deadline was extended to October 2026. A structural inequity persisted throughout: claims were valued in yen at 2014 exchange rates, meaning creditors received only a fraction of Bitcoin's appreciated value, while surpluses beyond those yen-denominated figures remained subject to ongoing legal dispute.

The regulatory consequence was immediate and lasting. Japan enacted the Virtual Currency Exchange Act in 2016, requiring exchanges to register with the Financial Services Agency and meet capital adequacy, security, and AML standards. The collapse directly shaped subsequent global debates on proof-of-reserves requirements, cold storage standards, and the legal classification of custodied cryptocurrency — debates that remain unresolved in many jurisdictions as of mid-2026.

Lessons

  1. Exchange dominance measured by trading volume does not reflect custodial competence; at Mt. Gox, volume concentration compounded risk by placing the majority of a global market's assets under a single set of inadequate controls.
  2. Proof-of-reserves — a cryptographic attestation that on-chain holdings match user liabilities — would have surfaced the Mt. Gox shortfall years before it became a bankruptcy. Its absence was the single most consequential information gap in the collapse; no depositor had any independent means to verify what the exchange actually held.
  3. A credible technical explanation for a withdrawal freeze — no matter how superficially plausible — does not justify continuing to deposit funds; the appropriate response to any withdrawal halt on a custodial platform is immediate escalation and, where possible, attempted withdrawal of remaining accessible balances.
  4. The criminal acquittal of an exchange operator on embezzlement charges does not confirm that the platform was honestly run; it confirms only that the prosecution's specific theory was not proven. The 650,000 Bitcoin gap remained unexplained after the acquittal.
  5. Regulatory registration in a major financial jurisdiction — and the audit, capital, and incident-reporting obligations that accompany it — is not a bureaucratic formality; it is the mechanism by which sustained, multi-year insolvency is detected before it becomes catastrophic.

References