February 2014
Mark Karpeles was spending many of his days in early 2014 in a space on the ground floor of the Tokyo office building that housed Mt. Gox. Mark was turning the space into what he called the Bitcoin Café, a real-world showcase for Bitcoin in Tokyo—with a register that would be powered by a point-of-sale system that Mark had been designing. Mark was spending his time working out the details of the café, down to the programmable LED lighting on the ceiling and the recipes for the pastries that would be served. The café was almost ready to open, with wine on the shelves and light blue Bitcoin Café mugs sitting next to the register.
As he puttered around the café, Mark did not look like a man responsible for a financial company that was in the throes of an existential crisis. For most of January, the price of a Bitcoin on Mt. Gox had been almost $100 higher than on any other exchange. This was a result of the continued difficulty that Mt. Gox was having in transferring withdrawals to customers outside Japan. Mark blamed this on American banks, which refused to accept wire transfers from his Japanese bank. For all the people with dollars stuck at Mt. Gox it seemed that the only way to get money out was by using the dollars trapped in the exchange to buy Bitcoins and then transferring the Bitcoins out of Mt. Gox. The pressure of all these people trying to buy Bitcoins on Mt. Gox, with no ability to go elsewhere, allowed sellers on Mt. Gox to charge higher and higher premiums for their coins.
Then, in late January and early February, something even more worrisome started happening that sent the price heading in the other direction. The customers earlier in January had complained about the difficulty of getting dollars out of Mt. Gox, but now a growing number of Mt. Gox customers reported that they had requested withdrawals of Bitcoin and never gotten the coins. A few days after the hearings in New York, Mark put up a formulaic statement on the Mt. Gox website acknowledging the problem: “Please rest assured that this is only affecting a limited number of users and transactions, and that we are working hard on resolving this problem as soon as possible.”
The thirty or so Mt. Gox employees in the company’s Tokyo offices knew little more than Mt. Gox customers about what was going wrong. When Mark wasn’t working on the café, he was in his office, behind a locked door on the eighth floor, far from the second- and fourth-floor offices where most of his staff was located. There were visible signs that all the stress was wearing on Mark. He was not yet out of his twenties but gray hairs were visible in his big black mane and he was clearly gaining weight. People in the office heard that Mark’s Japanese wife had taken his young son and gone to live with family members in Canada, but Mark said nothing about it. Mark rarely interacted with his employees and maintained the same grip on the company’s essential accounts that he had back in 2011 when Roger Ver came to help after the first big crisis at the exchange. The alienation from the ordinary world, which had helped lead Mark to Bitcoin, also made him a terrible person to run a Bitcoin company.
The Mt. Gox employees were as surprised as the exchange’s customers when Mark decided, on Friday, February 7, to shut off all withdrawals from Mt. Gox. The panic that this caused only got worse on Monday when Mark provided the first explanation of what was going wrong. In a statement, Mark explained that the exchange had run up against a flaw in the Bitcoin protocol. The flaw, known as transaction malleability, allowed devious users to alter the codes that identified transactions in a way that made it impossible to tell if a transaction had gone through. Users in the know could request a withdrawal, change the code, and then request the same withdrawal again. Mark, in his statement, said this was not just a problem for Mt. Gox, but an issue with the Bitcoin software, which should have been fixed earlier.
The statement immediately sent the price of Bitcoin plunging on every exchange around the world—a flaw in the Bitcoin protocol could jeopardize everything. And Mark was correct that transaction codes had been susceptible to alteration for some time. What he didn’t mention was that all the other major Bitcoin companies had known about the issue for years and had designed around it, generally by not relying on the transaction code in question. Gavin Andresen, the chief scientist at the foundation that Mark had funded, quickly came out swinging against Mark and said that the issue was not a bug, but a quirk, which others had dealt with easily. Mark came under withering attack from nearly every developer working on the Bitcoin software.
“MtGox tried to blame their issues by throwing Bitcoin under a bus and I am glad there has been a public rebuttal showing up their incompetence,” one programmer on the developer e-mail list wrote.
After Mark publicized the issue, transaction malleability did, in fact, become a point of attack on the Bitcoin network. Bitstamp, the largest exchange, shut off Bitcoin withdrawals one day after Mt. Gox’s announcement. But Bitstamp emphasized that it had lost no money as a result of the issue and, after putting together a quick patch, it was back up by the end of the week. Other exchanges remained open throughout. Mt. Gox, on the other hand, remained closed, creating a growing fear that something bigger was wrong.
WHEN MARK KARPELES showed up for work on Friday morning, his umbrella barely protected him from the unfriendly wet snow falling from the sky. He was wearing a short-sleeved shirt that hugged his round body, and he carried a large frothy coffee drink. Almost all the other exchanges around the world had recovered from the transaction malleability scare, but Mt. Gox showed no signs of allowing customers to again withdraw money. Mark’s entrance to the building was blocked by a young man who had flown to Tokyo from London two days earlier to try to get some answers. With a sign in one hand that said, “Mt Gox where is our money,” the protester, a mustachioed programmer named Kolin Burges, placed himself in Mark’s way and said, “Please, can I have a chat with you?”
Mark first tried to dodge him, but then stopped reluctantly when the man said, “I came all the way from London to try and get my Bitcoins from you—to find out what’s happened.”
“We can’t do anything right now,” Mark said, looking both disdainful and scared. He started again toward the door when Kolin asked the key question: “Do you still have everyone’s Bitcoins?”
“Can you let me get inside please,” Mark said as he tried to pass Kolin, who was bobbing and weaving to get in his way. “I’m going to call the police,” Mark threatened, before Kolin finally let him pass.
Upstairs in the Mt. Gox offices, the staff didn’t know any more than Kolin did about what was going on. They were still operating the exchange, allowing people to buy and sell Bitcoins with whatever dollars were still in their Mt. Gox accounts and taking in new deposits from daring customers. The price of a Bitcoin on the exchange fell lower and lower as people doubted they would ever be able to get the coins out. On Friday, the price stood at $300, half what it was on Bitstamp. Some people, including Roger Ver, were convinced that Mt. Gox’s problems were temporary and jumped at the chance to buy coins on the cheap.
Mark would later say that during this time he was spending his daylight hours at the office and his nights at his apartment, alone with his cat Tibanne, furiously working his way through hundreds of pieces of paper containing the private keys to Mt. Gox’s Bitcoin wallets. He had driven around in his car and collected the papers from the three locations in Tokyo where he had stored them (he had kept the keys on paper so they would not be vulnerable to hackers). Once he was back in his apartment with the QR codes—essentially complex bar codes—he began scanning in the private keys one at a time, with his computer’s webcam. A combination of fear and sickness slowly overtook him as each one of the wallets he scanned in showed up on his computer screen as empty.
It would be hard for others to verify Mark’s narration of what happened during those days because he kept such tight control over all the exchange’s accounts. And as time went on, fewer and fewer people believed anything Mark said. But even if he was telling the truth, it was not what he told his employees and customers when he came in to work on Monday morning, ten days after Mt. Gox shut off withdrawals. In a public statement on the Mt. Gox site on Monday, he said, “We have now implemented a solution that should enable withdrawals and mitigate any issues caused by transaction malleability.”
On the narrow Tokyo street outside the office, Kolin Burges maintained his one-man protest. There were still few Japanese people using Bitcoin, but Kolin did attract a few foreign supporters who showed up as the week went on without any sign of a resolution to the problem. Mark had two security guards advise the staff on how to deal with intimidating encounters. Mark himself started taking taxis to work and leased space in an office tower with better security. On Friday, Tokyo police showed up to remove the protesters.
A few hours after the police left, the Winklevoss twins landed in London for a weekend appearance at Oxford University. When they turned on their phones in the plane, they found a worrisome e-mail from Mark’s deputy, Gonzague, with whom they had dealt in the past.
“I would like to talk to you urgently regarding the situation with MtGox,” he wrote. “Would you mind signing this NDA and call me ASAP on my mobile phone.”
Cameron Winklevoss replied that a nondisclosure agreement could be tricky, but he was happy to talk. After being out in London all day, Cameron finally managed to connect with Gonzague by Skype when he got back to his hotel Friday night.
Gonzague got right to the point and explained the staggering extent of the problem: some 650,000 Bitcoins—essentially all the company’s customer holdings—were gone, along with 100,000 coins that belonged to the exchange.
Cameron was stunned. Doing the most basic math in his head, he knew that Gonzague was talking about hundreds of millions of dollars worth of Bitcoins.
“How is that possible?” was all Cameron could ask.
Gonzague said that someone had been stealing from the company’s online, or hot, wallet by changing the transaction identifiers. When the hot wallet was empty, Mark had unwittingly refilled it with coins from the cold, offline wallets. Gonzague told Cameron that Mark had continued doing this over and over again, until all the offline wallets were empty. The whole thing had been going on for months, or even years, and Mark apparently never realized it until now.
The explanation struck Cameron as implausible, but it didn’t seem worthwhile to argue now. The bigger question was what was going to happen next.
Gonzague sounded oddly upbeat. He explained that Mark had “burned himself” and was agreeing to step aside, making it possible to move the business to Singapore and reincorporate under new owners, with the twins being obvious candidates. Gonzague thought it would be possible to do this without telling anyone what had happened. If the exchange could get an infusion of coins the business could make up the missing money over time, from fees. If this wasn’t done, Gonzague said ominously, it could set Bitcoin back years.
It didn’t seem like a terribly attractive business proposition to Cameron, but he wanted to hear more—if only to understand how bad this was all going to be for his Bitcoin holdings. He asked Gonzague to send him some sort of concrete plan for what they had in mind.
The next day Gonzague sent the twins a twelve-page document, labeled “Crisis Strategy Draft.” It had been put together for Mark and Gonzague by a small public relations firm run by some Americans living it Tokyo. It was clearly a draft document, with typos and inconsistencies, but it pulled no punches about what had happened:
The reality is that MtGox can go bankrupt at any moment, and certainly deserves to as a company. However, with Bitcoin/crypto just recently gaining acceptance in the public eye, the likely damage in public perception to this class of technology could put it back 5~10 years, and cause governments to react swiftly and harshly. At the risk of appearing hyperbolic, this could be the end of Bitcoin, at least for most of the public.
After reading through the document, and its four-part plan for closing Mt. Gox temporarily and reopening it under new owners, the twins still couldn’t figure out what was being asked of them, other than putting a lot of money into a failing company.
“I understand the larger points you raise, but it is unclear to me what the exact plan of action here is,” Cameron wrote back.
The twins were not the only people to whom Mark and Gonzague were looking for a lifeline. They also sent the Crisis Strategy Draft to Barry Silbert in New York, who had his Bitcoin Investment Trust up and running with tens of thousands of Bitcoins. Essentially everyone told the Mt. Gox team the same thing: there was nothing to do but admit the losses and declare bankruptcy. When Roger Ver met the Mt. Gox team at the Tokyo American Club on Monday morning, he told them that no one in the world had enough Bitcoins to bail them out, except perhaps Satoshi Nakamoto. Mark and Gonzague didn’t believe it, and wanted to keep the information in a small circle of people to give them more time to find a savior. After Mark refused to admit the problem in a call with members of the Bitcoin Foundation, Roger angrily called some of the foundation members himself and let them know what was happening.
Once the word spread among the top Bitcoin companies on Monday, they all began preparing for something that had the potential to take down the whole Bitcoin experiment. In a shared Google document, they worked on a joint statement that gave their best argument for why people should not lose hope. Ordinary Bitcoin users got some indication that something was wrong when Mt. Gox’s Twitter account suddenly disappeared on Monday. But Gonzague and Mark continued to hold out hope that someone would come in and bail them out. When Cameron wrote on Monday to ask what was going on, Mark said he was planning to begin talking with a bankruptcy judge on Tuesday. But, he emphasized, “Our current goal is to try to save MtGox before filing for bankruptcy—in which case filing wouldn’t be required anymore.”
The growing bubble of uncertainty over how this would all play out finally burst on Monday night when a popular Bitcoin blogger, known as the Two Bit Idiot, posted a leaked copy of the Crisis Strategy Draft. As it began to circulate and the Bitcoin masses tried to determine if it was legitimate, there was a sense of suspended motion on the forums and message boards, with everyone waiting for the bottom to fall out. The companies putting together the joint statement—Coinbase, Blockchain.info, BTC China, Bitstamp, and Jesse Powell’s exchange, Kraken—were caught off guard by the leak and rushed to complete their statement, which ultimately came out a few hours after the leak. The companies urged Bitcoin owners to understand that the losses were the result of irresponsibility and bad behavior, not of a deeper flaw:
“This tragic violation of the trust of users of Mt. Gox was the result of one company’s actions and does not reflect the resilience or value of Bitcoin and the digital currency industry.”
The price did begin dropping on Bitstamp and other exchanges. But the free fall unexpectedly slowed within a few hours, before the price hit the low it had reached back in December when the Chinese exchanges turned off deposits. Many people seemed willing to believe the idea that there was nothing wrong with Bitcoin; there was talk that the disappearance of the most disastrous company ever to touch Bitcoin could end up being a good thing for the technology. If nothing else, people had invested enough time and money that they couldn’t stomach selling out of a trough. By Wednesday morning, the price was back up where it had been when the Mt. Gox news came out.
Still, under the apparently calm surface, there was immense and largely unseen damage. As the enormous figures from Mt. Gox suggested, tens of thousands of people had kept their money with the exchange despite all the warnings, and those holdings, estimated at over $400 million the week before, had now disappeared in a mysterious puff of smoke. Roger had a Japanese friend, whom he had convinced to buy Bitcoins and who had left $12 million worth of coins with the exchange. The older man in Argentina who had purchased large numbers of coins from Wences Casares, back in 2012, had also kept them with Mt. Gox. The man had been using Bitcoin to keep his retirement savings out of the unreliable peso—but now it was Bitcoin that failed him. The man wrote in an e-mail to one of Wences’s friends in Argentina that his life had been turned upside down by the event:
I’ll tell you that the collapse of Mt. Gox, where I had put absolutely all of my savings, left me more than demoralized. Not only because of the money, which was a lot, but because it destroyed the hopes I had created for using it as my wife and I got older. Each time this comes up it really hurts my health.
The same week as the collapse, lawyers in Chicago and Denver filed a lawsuit seeking class-action status to represent all the victims, and federal prosecutors were sending out subpoenas to aid in the criminal investigation they launched.
Even many of the victims blamed Mt. Gox rather than Bitcoin. Nothing had gone wrong with the Bitcoin protocol. In fact, Mt. Gox had long been held up as an example of the dangers that arose when Bitcoin users relied on central institutions, rather than the system of private keys and personal wallets that Satoshi had designed.
And yet, Bitcoin’s standing as a universal money, answerable to no government—and beyond the reach of any one government—had opened the way for companies like Mt. Gox, companies that took advantage of the fact that in the Bitcoin industry, each person could make up his own rules. This wasn’t a problem with the protocol but it was an issue with one of the central ideas that had motivated Bitcoin: the supposed benefit of releasing money from all the outdated rules and regulations that governed the existing financial system. Mt. Gox was, of course, not the first example of the dangers that arise in a system in which no one is responsible for providing oversight. An academic study in 2013 had found that 45 percent of the Bitcoin exchanges that had taken money had gone under, several taking the money of their customers with them. One of the most trenchant critics of Bitcoin, the Financial Times writer Izabella Kaminska, put it well in the days after the collapse:
The only way to stabilise the system is to rid it of the “cheating incentive”—that being the incentive that encourages the “prisoner” to take the high-risk selfish strategy. Most of the time that depends on establishing a system of enforced protocols or regulations that penalise rulebreakers above and beyond the potential benefit of cheating.
Some of the recent converts to Bitcoin were not opposed to some sort of government oversight for this fledgling market. Ben Lawsky in New York used the incident to push ahead faster with his BitLicense. But it was somewhat unclear whether there would be anything left to license.