The Mt. Gox Collapse (2014): How the Largest Bitcoin Exchange Failed

In February 2014, Mt. Gox, then the best-known Bitcoin exchange in the world, stopped withdrawals and shortly afterwards filed for bankruptcy protection in Japan. It reported that hundreds of thousands of customer bitcoins were missing. The collapse is one of the defining events in crypto history and it is often cited when people repeat the saying "not your keys, not your coins."

Where the name came from

Mt. Gox began as a trading site for Magic: The Gathering cards, short for Magic: The Gathering Online eXchange, created by Jed McCaleb. McCaleb converted it to a Bitcoin exchange in 2010 and sold it in early 2011 to Mark Karpeles, a French developer living in Japan. Under Karpeles it became the largest Bitcoin exchange, handling a large share of global trading volume by 2013. The odd name was never changed when the site became a Bitcoin exchange, and its quoted price was widely used as a reference by news outlets at the time.

Early warning signs

The exchange had problems before the collapse. In June 2011, an attacker compromised an administrator's account and caused a sudden crash in the displayed price, and the exchange had to freeze trading and roll back. Over the following years, customers reported slow withdrawals, particularly in the autumn of 2013 and early 2014. Mt. Gox attributed delays to a technical issue known as transaction malleability, which lets a transaction's identifier be altered before confirmation, and which can confuse systems that track withdrawals by ID.

The collapse

Withdrawals were halted in early February 2014. In the last week of February the exchange's website went offline. A document, which circulated at the time and described a loss of around 744,000 bitcoins, was widely reported. On 28 February 2014, Mt. Gox filed for bankruptcy protection in Tokyo. The company stated that about 750,000 customer bitcoins and about 100,000 of its own had gone missing. Later, around 200,000 bitcoins were found in an old wallet, which reduced the reported shortfall.

The exact causes were disputed for years. Mt. Gox first pointed to theft by exploiting transaction malleability, but independent researchers questioned whether malleability could explain losses on that scale. Later analysis suggested that thefts had occurred over a long period.

Legal proceedings

• Bankruptcy. The case moved from bankruptcy to civil rehabilitation proceedings in Japan, with a trustee managing recovery and creditor claims.
• Criminal case. Karpeles was arrested in Japan in August 2015. In 2019 a Tokyo court convicted him of data manipulation and gave him a suspended sentence, but acquitted him of embezzlement charges.
• Repayments. The trustee held recovered bitcoin and bitcoin cash for creditors. Distribution to creditors began in July 2024, after earlier deadlines had been extended. The deadline for completing repayments has since been pushed back again several times, most recently to October 2027.

What it changed

Mt. Gox led to practical changes in the way exchanges are run and regulated:

1. Proof of reserves. Customers and critics began to ask exchanges to prove they held what they owed. Over time, some exchanges introduced audits or cryptographic proofs, although practices still vary.
2. Cold storage. The industry moved toward keeping most customer funds offline, away from internet-connected servers.
3. Regulation. Japan passed a law in 2016 requiring exchanges to register, which took effect in 2017.
4. Self-custody. Many users learned to hold their own keys rather than leave coins on an exchange.

Transaction malleability in brief

Every Bitcoin transaction has an identifier, which is a hash of its data. Before the SegWit upgrade, it was possible for a third party to change the encoding of a signature without invalidating the transaction, which altered the identifier. If a system tracked a withdrawal by its identifier, it could then believe the withdrawal had failed, even though it later confirmed under a different one. The flaw was well known to developers, and it affected how exchanges tracked payments. SegWit, activated in 2017, removed this kind of malleability for transactions that use it. Whether it explained the missing coins at Mt. Gox is the part that was contested.

The practical takeaway for any service that handles payments is to track them with reliable internal records, not a single identifier from outside. If you need to understand common operational topics, the knowledge base covers many everyday hosting tasks.

Custody options compared

Keep the facts straight

Because many numbers circulated at the time, it is useful to be careful. The figure of roughly 850,000 bitcoins is the combined amount Mt. Gox reported as missing initially, and about 200,000 were later found. Dollar values depend on the date chosen, and this article does not attempt to forecast prices.

A practical lesson for site owners

If your business receives crypto payments, avoid leaving funds with a single point of failure and keep records of what you are owed. If you run a site with a payment function, keep backups and updated software. The Zebra Hosting security page explains the baseline protections included with our plans.