Independent investigators say most bitcoins from Mt.Gox were likely stolen and sold in 2011-2012, when bitcoin prices were very low.

After the crash of Mt.Gox in February 2014, when as much as 650,000 BTC went missing, many independent investigators looked at blockchain transactions in an attempt to figure out what had happened with the once dominant bitcoin marketplace. Yesterday, one of these teams published its report. The authors believe their investigation “is probably both the longest-running and the one that has made the furthest progress”. They identified at least two million Mt.Gox bitcoin addresses, allowing them to analyze the in- and outflow of the digital currency.

Their first publication, in May 2014, looked at the actions of the Mt.Gox bitcoin-buying bot that boosted the price of the cryptocurrency back in 2013. The new investigation is dedicated to the bitcoins that were withdrawn from Mt.Gox, leading to its epic downfall. Authors say they decided to publish the preliminary results of their investigation ahead of the Mt.Gox creditors’ meeting expected in the near future and because of the ongoing speculation about the role of Federal Agents in the Mt.Gox crash. As CoinFox reported recently, two former federal agents, Carl Mark Force IV and Shaun W. Bridges, have been arrested and charged with stealing bitcoins from Silk Road and extorting money from its owner. Following their arrest, Mark Karpeles published a number of incriminating email screenshots, giving rise to suggestions that Mt.Gox was brought down by the greed of corrupt government officials.

According to the investigation, the federal agents had nothing to do with the problems Mt.Gox experienced because most bitcoins had already been stolen by that time – in fact, they had been withdrawn between June 2011 and May 2012. In June 2011, Mt.Gox had at least 424,242 BTC, as demonstrated by the bitcoin transaction made by Mark Karpeles. However, after this date the funds started to leak out. The investigators have so far been unable to trace the movement of many of the Mt.Gox bitcoins in the period between July and November 2011 but in November, according to their research, the gap between the expected and the actual number of bitcoins in the exchange was already enormous, approaching 400,000 BTC. The gap continued to grow until May 2012 and remained unchanged afterwards. When a number of clients pulled their bitcoins out of Mt.Gox in the late 2013, there was suddenly nothing left.

Stolen Mt.Gox bitcoins were sent to an outside address and then went to various bitcoin exchanges, including Mt.Gox itself, where they were sold for fiat, says the report. At the time of the Mt.Gox crash the price of one bitcoin was around $600, which made the amount lost in fiat equivalent absolutely enormous; however, the bitcoin price was much lower in 2011-2012, which would mean that, if the authors are right, most stolen bitcoins were sold for less than $20 apiece.

The authors make no claims to knowledge of the thief’s identity. They say that “narrowing down actual suspects is close to impossible without proper access to all available data” and it could really be done only by law enforcement.

In January 2015, a Japanese newspaper, citing insider sources in the police, reported that only 7,000 Mt.Gox bitcoins were lost through an external attack while the rest were stolen by people from inside the exchange.

Alexey Tereshchenko