Mt. Gox Hack: A Year-by-Year Timeline of the 850,000 Bitcoin Collapse

A popular version of the Mt. Gox hack says thieves broke in one night in early 2014 and emptied a famous bitcoin exchange. That story gets both the date and the method wrong. The coins started leaving in 2011, and the exchange's own records failed to show it for more than two years.

This case study follows the Mt. Gox collapse year by year, from the first break-in to a repayment process that is still running in late 2026. Here is what you will find below:

• A dated timeline table from 2011 to the current repayment deadline
• How the theft worked, explained without technical jargon
• Why the reported losses range from 386 to 850,000 bitcoins
• Who US prosecutors charged, and how firm that attribution is
• Numbered lessons for crypto users and businesses in Pakistan

What Was the Mt. Gox Hack?

The Mt. Gox bitcoin exchange was based in Tokyo. In 2011 it was the largest Bitcoin exchange in the world, according to the US Justice Department. People deposited coins and cash, traded, and left balances on the site. Many traders in Pakistan do the same with exchange apps today.

The Mt. Gox hack was not one dramatic night. It was a slow leak that started in 2011 and stayed hidden for years. When the exchange finally stopped, it told the world that hundreds of thousands of bitcoins were gone. According to a 2019 AFP report on phys.org, about 850,000 bitcoins disappeared when Mt. Gox shut down in 2014, worth roughly half a billion dollars at the time.

Two different problems were tangled together. Outside attackers stole coins from the exchange's wallets. Inside the company, weak record-keeping meant nobody noticed for a long time. Keep both in mind as you read the timeline.

The Mt. Gox Hack Timeline, From 2011 to 2027

The table below lists the key dates in the Mt. Gox hack. Japan is four hours ahead of Pakistan. So a Tokyo announcement during office hours usually reached Pakistan the same morning or early afternoon.

2011: The First Break-In and the Slow Leak

The first public warning came in June 2011. PCWorld reported in July 2011 that an attacker used a compromised administrator account to create about 2 million fake bitcoins inside the exchange's own database. The price on Mt. Gox crashed to about a penny. The attacker left with roughly 2,000 real bitcoins before trading was stopped. In the same period, the user database leaked online with email addresses, usernames and hashed passwords.

That incident was loud. The bigger part of the Mt. Gox hack was quiet. In a June 2023 press release, the US Justice Department alleged that attackers gained access in or about September 2011 to the server in Japan that held the Mt. Gox wallets. That server also stored the private keys, the secret codes that approve any transfer. With the keys, the attackers could move coins as if they were the exchange.

Why Nobody Noticed for So Long

A crypto exchange keeps two records. One is its own database, which shows what each customer owns. The other is the blockchain, which shows what the exchange's wallets actually hold. If those two records are not compared often, a thief can take coins from the wallet while the database still shows healthy balances.

That is what independent researchers believe happened. In a 2015 analysis by the Tokyo security firm WizSec, the authors traced about 300,000 bitcoins leaving between late 2011 and the end of 2012. They found transfers with no matching withdrawal record. Their view is that staff may have kept refilling a leaking hot wallet, the online wallet used for daily withdrawals, without seeing the hole.

Did Transaction Malleability Really Empty Mt. Gox?

When withdrawals stopped in February 2014, the company did not describe a Mt. Gox hack at first. It pointed to a flaw called transaction malleability. In simple terms, it allowed someone to change a Bitcoin transaction's ID before the network confirmed it. A careless exchange could then think a withdrawal had failed and send the coins a second time.

Researchers tested that claim with real data. Christian Decker and Roger Wattenhofer of ETH Zurich had been recording Bitcoin network traffic since January 2013. In their 2014 paper on malleability and Mt. Gox, they found that before the withdrawal freeze, malleability attacks could explain at most about 386 bitcoins in losses. Most of the attacks they saw came after Mt. Gox's own February 10 statement, as copycats tried their luck.

The paper's conclusion was blunt: the exchange still had to explain where about 849,600 bitcoins went. Malleability was a real weakness in how some exchanges tracked withdrawals. It was not the main cause of the Mt. Gox collapse.

How Much Was Lost? Four Figures Explained

You will see several loss figures quoted for the Mt. Gox hack. They come from different sources, measured at different times, so they do not cancel each other out.

• 850,000 bitcoins: the figure reported at the 2014 shutdown, which the ETH Zurich paper says included about 750,000 customer coins and the rest owned by the company.
• About 650,000 bitcoins: the revised loss after the exchange reported finding 200,000 bitcoins in an old wallet, according to CoinDesk in March 2014.
• At least 647,000 bitcoins: the amount the US Justice Department alleges the hackers stole, mostly from customers.
• About 386 bitcoins: the upper limit ETH Zurich could link to malleability before the freeze.

The 650,000 and 647,000 figures are close because they describe the same stolen coins, counted by different parties. The 850,000 figure was high because the old wallet had not yet been found. WizSec, working from leaked data and the blockchain, also arrived at roughly 650,000 bitcoins missing for good.

Who Was Blamed, and How Confident Is That?

Here it helps to separate court findings from allegations.

What a Court Has Decided

Mark Karpelès, the chief executive, was arrested in August 2015. According to AFP's report of the March 2019 verdict, a Tokyo court found him guilty of tampering with computer data. It acquitted him of embezzling about 341 million yen of client money. He received two and a half years in prison, suspended for four years. Prosecutors had asked for 10 years. So the court did not find that he stole customers' bitcoin.

What US Prosecutors Allege

In June 2023, the US Justice Department charged Russian nationals Alexey Bilyuchenko and Aleksandr Verner with money laundering conspiracy linked to the theft. Prosecutors allege the group moved stolen coins from September 2011 until at least May 2014. They say most of the coins were laundered through other exchanges. A separate case alleges that Bilyuchenko helped Alexander Vinnik run BTC-e, an exchange shut down by US authorities in 2017.

These are charges, not convictions. The DOJ release itself reminds readers that every defendant is presumed innocent unless a court finds otherwise. The attribution is detailed and backed by blockchain tracing, which makes it stronger than a vague claim. Still, you should describe it as an allegation until a court rules.

After the Collapse: A Trustee and a Twelve-Year Wait

After the bankruptcy, a court-appointed trustee took control of the remaining coins and cash. Creditors waited about a decade for any coins. Repayments in bitcoin and bitcoin cash began in 2024, and Blockhead reports that more than 17,000 creditors were paid through exchanges by the end of July that year.

The process is still not finished. Blockhead reported in October 2026 that the trustee moved the Mt. Gox repayment deadline from October 31, 2026 to October 31, 2027. It was the fourth extension of a deadline first set for October 31, 2023. The trustee said many creditors had not completed the required steps, and some payments had run into problems.

The same report cites a trustee update from March 2025 saying about 19,500 creditors had been repaid. It also cites blockchain analytics firm Arkham, which counted about 34,387 bitcoins still in the estate's labelled wallets on September 30. Treat that holding as an outside estimate, since the trustee's notice did not state one.

For comparison, other large crypto thefts moved much faster. You can see how in the Bybit hack case study and the Ronin Network hack lessons, where losses were found within hours or days rather than years.

What Does Mt. Gox Mean for Crypto Users in Pakistan?

Many Pakistanis now hold crypto through foreign exchange apps or peer-to-peer trades. The Mt. Gox hack shows what can happen when a platform holds your coins and you cannot see its books.

Pakistan is building rules for this market. Dawn reported in July 2025 that the federal cabinet approved a Pakistan Virtual Assets Regulatory Authority. According to the Ministry of Finance, it would license and supervise virtual asset service providers in line with FATF guidelines, including anti-money laundering and cyber risk controls.

Licensing helps, but it does not replace your own checks. Mt. Gox looked busy and trusted right up to the day it froze. The same pattern appeared in the Binance hack explainer and, in a different form, the 2018 Pakistan bank data breach, where weak controls stayed hidden until money was gone.

Crypto Exchange Security Lessons From Mt. Gox

Good crypto exchange security comes down to a few boring habits done every day. These lessons are written for defenders, students and ordinary users. They focus on controls, not on how to repeat an attack.

For Exchanges and Businesses

1. Reconcile every day. Compare the customer ledger with on-chain wallet balances on a fixed schedule. A gap of even a few coins should open an investigation.
2. Keep the hot wallet small. Hold only what daily withdrawals need online. Store the rest offline, with more than one person required to approve large moves.
3. Protect admin accounts first. The 2011 price crash began with one compromised administrator login. Use hardware keys, separate admin devices and alerts on unusual admin activity.
4. Keep private keys off general servers. The DOJ says the Mt. Gox wallet keys sat on a server attackers could reach. Use dedicated key storage hardware where possible.
5. Make logs tamper-evident. Withdrawal logs that can be edited or skipped hide theft. Write security logs to a separate system that operators cannot change.
6. Allow outside audits. In our view, an independent check of reserves would likely have found the hole years earlier.
7. Tell users the truth early. Mt. Gox's malleability statement pointed the blame elsewhere. Honest disclosure protects users and the company's credibility.

For Individual Users

1. Keep on any exchange only what you actively trade.
2. Turn on app-based two-factor login and a withdrawal address allowlist.
3. Download your trade history and balances regularly, so you can prove a claim if a platform fails.
4. Ignore anyone who offers to "recover" lost crypto for an upfront fee.

The account security habits here overlap with protecting messaging apps, which our WhatsApp recovery checklist covers step by step.

Tracing Old Exchange Failures in PSTA's Security Labs

Old cases like the Mt. Gox hack are useful in class because the evidence is public. Students can read a court verdict, a DOJ filing and an academic paper, then compare what each one proves.

PSTA's Cyber Security & Ethical Hacking course runs for 12 weeks at beginner level. No prior security background is needed. The course page lists labs on building a safe practice lab, vulnerability scanning and spotting common attacks. Students also configure firewalls and intrusion detection, then investigate an incident and document its timeline. It ends with a case-study project and a written security report. Classes run on campus in Abbottabad, and the same batch can be followed live online from other cities.

Students who finish the basics and want to test systems with permission can move on to the Advanced Ethical Hacking & Penetration Testing course, an intermediate program that also lasts 12 weeks.

Write Down Where Your Keys Live

The myth of a single raid in 2014 hides the real lesson. The coins began leaving in 2011, and the records that should have shown it were not being checked. Tonight, list every place you hold crypto and note who controls the keys for each one. If the answer for a large balance is "the exchange," decide whether that still makes sense. If you would like guidance on a security course, our team is happy to talk it through when you are ready.