The WizSec firm (Kim Nilsson et al.) traced Bitcoin blockchain transactions and concluded that the Mt. Gox losses began in 2011 — three years before the bankruptcy — through systematic key compromise, not malleability attacks.

Bitcoin core developers publicly responded to Karpelès' malleability claim, stating that a properly designed exchange should not be vulnerable to the type of drain described. The technical community broadly rejected the malleability explanation as the primary cause.

While Karpelès was acquitted of embezzlement charges, he was convicted of manipulating Mt. Gox's database to inflate his personal account balance by ~$1M. The data falsification conviction confirms dishonesty in his handling of the exchange's systems.

The 2017 US indictment of Vinnik alleged BTC-e received approximately 300,000 BTC linked to the Mt. Gox theft for laundering. This establishes a receiving channel for stolen coins, supporting the theft-not-malleability account.

Approximately 142,000 BTC were recovered in the bankruptcy estate and are being distributed to creditors. Distributions at 2024 prices are dramatically more valuable than the 2014 fiat value, partially compensating creditors in dollar terms.

Japanese prosecutors did not prove embezzlement of the 850k BTC beyond a reasonable doubt. An acquittal establishes that the prosecution's case was insufficient, not that the underlying conduct did not occur. The civil bankruptcy record contains separate findings.

Post-collapse technical reviews identified that Mt. Gox's hot wallet management and private key security practices were seriously deficient for an exchange of its size. Poor key management is consistent with the WizSec account of systematic compromise.

Vinnik was convicted in France in 2020 and sentenced to five years for money laundering. He was subsequently extradited to the United States, where the charges include the Mt. Gox theft proceeds. The French conviction established his role as a money launderer.

The specific data falsification for which Karpelès was convicted involved inflating his personal Mt. Gox account balance by approximately $1 million by directly manipulating the exchange's database. This establishes both capability and willingness to manipulate the system.

Despite years of blockchain forensics, Japanese police investigation, and US prosecution of Vinnik, the identity of the person(s) who originally compromised Mt. Gox's private keys remains publicly unresolved. This is the central remaining uncertainty.

The WizSec firm (Kim Nilsson et al.) traced Bitcoin blockchain transactions and concluded that the Mt. Gox losses began in 2011 — three years before the bankruptcy — through systematic key compromise, not malleability attacks.

While Karpelès was acquitted of embezzlement charges, he was convicted of manipulating Mt. Gox's database to inflate his personal account balance by ~$1M. The data falsification conviction confirms dishonesty in his handling of the exchange's systems.

The 2017 US indictment of Vinnik alleged BTC-e received approximately 300,000 BTC linked to the Mt. Gox theft for laundering. This establishes a receiving channel for stolen coins, supporting the theft-not-malleability account.

Japanese prosecutors did not prove embezzlement of the 850k BTC beyond a reasonable doubt. An acquittal establishes that the prosecution's case was insufficient, not that the underlying conduct did not occur. The civil bankruptcy record contains separate findings.

Post-collapse technical reviews identified that Mt. Gox's hot wallet management and private key security practices were seriously deficient for an exchange of its size. Poor key management is consistent with the WizSec account of systematic compromise.

Vinnik was convicted in France in 2020 and sentenced to five years for money laundering. He was subsequently extradited to the United States, where the charges include the Mt. Gox theft proceeds. The French conviction established his role as a money launderer.

The specific data falsification for which Karpelès was convicted involved inflating his personal Mt. Gox account balance by approximately $1 million by directly manipulating the exchange's database. This establishes both capability and willingness to manipulate the system.

Despite years of blockchain forensics, Japanese police investigation, and US prosecution of Vinnik, the identity of the person(s) who originally compromised Mt. Gox's private keys remains publicly unresolved. This is the central remaining uncertainty.

Security researchers at WizSec conducted blockchain forensic analysis and concluded that the majority of the missing 744,408 BTC had been systematically stolen over years beginning in 2011 — not in the sudden 2014 collapse. The theft involved bitcoins being quietly siphoned from Mt. Gox's hot wallet, with the company apparently unaware of the growing deficit. This suggested operational incompetence rather than sophisticated exploitation.

US and Greek authorities indicted Russian national Alexander Vinnik in 2017 for operating BTC-e, an exchange allegedly used to launder 300,000 of the stolen Mt. Gox bitcoins. Blockchain analysis traced BTC from Mt. Gox addresses through multiple hops to BTC-e deposit addresses associated with Vinnik's accounts. Vinnik was eventually convicted in France and sentenced to five years imprisonment.

Bitcoin core developers publicly responded to Karpelès' malleability claim, stating that a properly designed exchange should not be vulnerable to the type of drain described. The technical community broadly rejected the malleability explanation as the primary cause.

Approximately 142,000 BTC were recovered in the bankruptcy estate and are being distributed to creditors. Distributions at 2024 prices are dramatically more valuable than the 2014 fiat value, partially compensating creditors in dollar terms.

Japanese prosecutors charged Karpelès with embezzlement but the Tokyo District Court acquitted him of those charges in March 2019. He was convicted only of manipulating electronic records — inflating Mt. Gox account balances — and received a suspended sentence. The acquittal on embezzlement was cited by defenders as proof he did not steal customer funds, while critics argued the prosecution had simply failed to prove the more serious charge.

Mark Karpelès was convicted by a Tokyo court in 2019 of data falsification — manipulating account balances — but was acquitted of the more serious embezzlement charge that would support theories of deliberate personal theft of customer funds. Japanese courts distinguished between the dishonest systems manipulation he committed and the allegation that he personally stole the missing bitcoin. The acquittal on embezzlement is legally significant: it means the court found insufficient evidence that Karpelès misappropriated the 744,000 BTC for personal benefit. Theories of Karpelès as the principal thief must contend with this acquittal, which was not a technicality but a finding on the core embezzlement allegation.

Mt. Gox CEO Mark Karpelès initially blamed Bitcoin's transaction malleability — a protocol characteristic where transaction IDs could be altered before confirmation, allowing fraudulent duplicate withdrawal claims. The core Bitcoin development community confirmed malleability was a real property of the protocol, though critics noted that a properly implemented exchange should not have been vulnerable to such a well-known issue.

Blockchain analysis by WizSec and others linked significant volumes of missing Mt. Gox BTC to addresses associated with BTC-e, the exchange operated by Alexander Vinnik. However, BTC-e was a major unregulated exchange processing funds from multiple illicit sources; its receiving stolen Mt. Gox BTC is consistent with it being a laundering destination rather than evidence that Vinnik or BTC-e conducted the original theft. The provenance of the BTC before reaching BTC-e-linked addresses has not been conclusively established. Vinnik was convicted in France of money laundering, not of hacking Mt. Gox. The connection establishes a laundering pathway, not the identity of the original attacker.