I’m going to say it. Something doesn’t seem right with the story we’re getting.

Who the hell runs a half-billion dollar business and doesn’t have accounting procedures in place good enough to notice the loss of nearly ALL ASSETS. According to the Crisis Strategy Draft leaked after the one-time largest Bitcoin exchange went dark, this was no sudden event:

At this point, 744,408 BTC are missing due to malleability-related theft which went unnoticed for several years. The cold storage has been wiped out due to a leak in the hot wallet.

And that is not the extent of the losses. In addition to those 750,000 bitcoins, another 100,000 BTC that were Mt. Gox’s private holdings were also apparently taken. The implication is that thieves were using transaction malleability to target Mt. Gox’s procedure of confirming withdrawals via transaction tags instead of confirming the transaction directly on the blockchain. The withdrawal would go through, but since the tag numbers didn’t match, Mt. Gox would think that it hadn’t and automatically process a second payment. The thief wouldn’t even have to take the trouble to submit a claim.

Mt. Gox has been saying for years that the bulk of their customers’ bitcoins were in secure cold storage in multiple locations. Now they say there was ‘leak’ in their cold storage procedures. This, of course, doesn’t make any sense as long as the cold storage had been created using well-understood procedures. It might suggest that Mt. Gox just kept ‘topping off’ their hot wallet every time it got low and never conducted an audit of its own books to see that funds were disappearing. It might also be that someone hacked their wallets, but since the Crisis Strategy Draft states that this was a malleability-related theft, this seems unlikely. Rather, it seems, we should believe Mark Karpeles drank expensive Starbucks coffees secure in his own superiority never realizing that he was losing hundreds  of BTC a day.

Though Karpeles has said the leaked strategy document was only one proposal on how to salvage Gox, an amazing element is that it includes a plan to revitalize the business. The plan includes closing down the exchange, reorganizing the management team, getting outside support, rebranding, and potentially reopening in another locale. After reportedly losing better than 95% of their own and their customers’ assets, this smacks of a gnomish business model:

1. Close and reorganize.
2. Rebrand.
3. ???
4. Profit!

The idea that other businesses would step in to help Gox out after such dramatic losses and incompetence smacks, as Laruen Orsini has pointed out, of an internal belief at the organization that they were too big to fail. She points out that they themselves may have believed that the end of Gox would be the end of Bitcoin, a fact, if true, that they hoped would spur other organizations to step in and help them. That help did not come, and as of this writing the price of BTC has largely recovered, proving that the value of Bitcoin was not tied up in Gox, but in what Bitcoin can and will do for people.

As of this reading, one portion of the Crisis Strategy Draft appears to be wrong. This draft states that Mt. Gox is now in control of only 2,000 BTC. However, one of the wonderful things about the blockchain is that it’s a public ledger of account showing every transaction ever confirmed. Once we know who is in control of particular addresses, then we know who owns those BTC.

In late 2011 there were concerns that Mt. Gox had lost its bitcoins and was insolvent. To quell those fears, Mark Karpeles shifted funds around on addresses that he advertised as a way of proving Gox’s solvency. It has now come to light that several of those address still have bitcoins totaling a 90,000 BTC unspent since that time. This means that Mark Karpeles, or Gox, is still in control of those bitcoins, and probably more that haven’t been traced. Or it may mean that they have lost the private keys, not unthinkable given the incompetency we’ve seen from Karpeles up till now. You can read about this in detail on LetsTalkBitcoin.com.

What Karpeles has been saying and what Gox has been doing has not made sense for a very long time. Investors are not taking this laying down; a class-action lawsuit has already been filed in the U.S. District Court for the Northern Disctict of Illinois by Gregory Greene on behalf of some 600,000 U.S. investors. Jay Edelson of Edelson PC, the firm engaged to press the suit, has said that they will be able to go ahead with the case since Tribanne, the company that own Mt. Gox also has subsidiaries in the U.S.

Karpleses’ troubles don’t stop there. On February 25^th, The U.S. Attorney for Manhattan, Preet Bharara sent subpoenas to Mt. Gox requesting documents relating to how it responded to the recent DDOS attack which caused it to halt BTC withdrawals.

Mark Karpeles says that he is still at home in Tokyo (where I also live) and has tweeted pictures of his cat annoying him by sitting on his keyboard as proof. I’m not sure how he thinks a cute picture of his cat will reassure his investors, or gather the support of the community to bail him out, but it certainly is in keeping with the picture we’ve gotten of him over the last year. Karpeles has been arrogant, aloof, incompetent, secretive, and blaming throughout this incident. He also seems not to grasp the severity of what is going on.

When the news first broke that Gox had lost three-quarters of a million bitcoins, my immediate response was the thought that the critics of Bitcoin were right: only criminals will own bitcoins because they will have stolen them all. I thought that every Bitcoin I own will have to be looked at to find out where it was stolen from. I am no fan of red listing coins, a move which would put Bitcoin at the mercy of governments, but I admit to having my moment of doubt.

Now, I am sure that the whole story of Gox has not been told. They have 2,000 bitcoins that they admit to. It seems Karpeles has control of at least 90,000 more bitcoins and I cannot believe that he lost the keys. It may be that Karpeles believes those coins are his alone, separate from Gox funds. I don’t know if government action or lawsuits would be enough to find out the true extent of Karpeles’, and other Gox principals’, wealth, but I am sure that now that some of those funds have been traced, if Karpeles tries to use them, he may have a rude awakening.

By Mark Norton. You can contact the author at [email protected]

March 1, 2014