For those living under a rock, a document surfaced which I can confirm is authentic regarding the insolvency of MtGox titled “MtGox Situation Crisis Strategy”
The document essentially claims that MtGox has ‘lost’ 740,000 BTC over the past few years, at currency price of $592 that amounts to $438,080,000 missing, unnoticed for about four years.
Let’s be honest, that kind of money does not just go missing and I’ve been struggling to accept that this is what really happened. On Sunday evening I called my good friend David Perry from CodingInMySleep.com to run the numbers and see if this is physically possible. For More Information, listen to the second half of Tuesdays Let’s Talk Bitcoin!
We concluded:
We find it hard to believe those coins are missing and the basic math alone should refute this. 740k btc since malleability became known in ’11 is 20k+ btc per month, about 675 btc per day. Even at current prices that’s over 300k USD per day, that’s not the kind of money you just misplace and don’t notice. Now, even if we give the “hacker” credit and suggest they’ve been doing it since the day gox opened that’s still a quarter million per day. In fairness the hackers could have taken a lot more coins when they were less valuable and dialed it back now that the USD value per coin is higher but it still works out to an average of 509 coins per day, if they started the day Gox opened shop. Even when coins were $0.05 that’s still almost $1,000 per month their books wouldn’t balance by. Were talking about 6% of all coins in existence, or ten times the amount of money in any known bitcoin address. If they’ve stolen that much money over that much time the law of averages kicks in, they’d be buying at the median market price for the entire 4 year span, which is $95.49 per coin for a daily take of $48,629.01. If you stole $48,629.01 worth of btc from Gox every day for 4 years, you arrive at 744,000 btc and they couldn’t have stolen the bulk of it right at the start because that many BTC didn’t exist 4 years ago. I’ve seen many emails and blog posts come across my inbox trying to explain what happened, but this is by far the best explanation I have seen.
LTB Listener @Napoleon sent this note :
Adam,
I’m listening to the latest LTB episode, and am presently paused at the point where Charlie Shrem is doing the math on how many bitcoins would have needed to have been stolen per day since Mt Gox’s inception for the 740,000 bitcoins to have disappeared. I believe I “deduced the MtGox situation” Tuesday morning. Only when I heard Charlie talk about it on the podcast and realized that even Mark’s friends didn’t know what was going on did I realize that I should reach out to someone. I rather cynically assumed that insiders were in-the-know and that many others would come to my conclusions soon enough. Perhaps I’m wrong, but because nobody else is talking about it I feel obliged to pass this through you to Charlie — who might be able to act on it.
Simple theory that is plausible and explains some of Mark’s behavior & statements:
Summary
1. A substantial amount of the missing 740k bitcoins are still in addresses that MtGox believed they had control over
2. Transaction malleability thefts did take place, but not nearly 740k coins
3. MtGox believed they were solvent because their watch-wallet continued and continues to show expected cold storage balances
4. MtGox’s deepest coldest-cold storage reserves were never tested until the transaction malleability situation
5. MtGox can not recover the keys to the coldest-cold storage. (possibly a software problem.. custom deterministic wallet? or some other hardware/organization failure)
6. Mark has reason to think that the keys might be recoverable
7. The 2,000 odd coins mentioned in the crisis document represent whats left of the first stage cold wallet/hot wallet coins
Background & Assumptions
I am not familiar with MtGox’s cold wallet management. I have never talked to anyone at MtGox or anyone knowledgeable about MtGox’s practices.
It is preposterous to imagine that 740k bitcoins were lost over any amount of time without anyone noticing. Zero percent likelihood. It is certainly possible that there has been a major coverup and fraud. My theory is the only answer I can come up with that is both plausible and does not involve massive fraud.
Theory
Different Cold Wallets
An operation at MtGox’s size and growth rate requires relatively few coins to satisfy customer withdraws at any given moment. For this reason, MtGox likely has a multi-tiered wallet system that is more complicated than simply a hot wallet and a cold wallet. Perhaps only 5%-20% of customer funds are required to be quickly accessible at any given moment, and perhaps these are split between a cold wallet and a hot wallet. For the vast majority of customer funds there exists a coldest-cold wallet. This coldest-cold wallet is never tapped, while the normal offline transaction signing process is used for the first stage cold wallet to hot wallet transfers.
Cold Wallets Are Watched
All cold wallets are set up in a watch-wallet format, and they balance. The cold wallet is regularly tapped, but with the growth of the site, it never requires the coldest-cold wallet funds. The coldest-cold wallet only grows over time — possibly representing some fixed percentage of total customer funds.
Malleability Hacks
Transaction malleability hacks have been taking place for some period of time, and MtGox was alerted to them. The cold wallet was mostly depleted in this process and for the first time in a long time, perhaps for the first time ever, the coldest-cold wallet was tapped to refill the cold wallet. It was then discovered that the coldest-cold wallet private keys were not functional or were missing.
Private Keys
There are any number of different reasons why the coldest-cold wallet’s keys are wrong/missing/corrupted. Perhaps there is a problem with the elliptic curve in the PHP custom wallet software. Perhaps a drive failed, perhaps a USB key was wiped, or just plain lost. Any number of reasons.
If it is a software problem with a custom wallet, then perhaps Mark believes he might be able to correct it and generate the correct private keys. If it is a data-loss problem then perhaps he thinks it is recoverable in some way.
Fiat Asset & Liabilities Imbalance
There are several ways to account for the shocking difference between the USD assets and liabilities, none strike me as ethical/legal. My guess is that it is the result of an ill-advised plan to continue trading during a sell-off while using customer funds to buy cheap BTC under the assumption that the private keys to the coldest-cold storage would be recovered. This is roughly what MF Global did.
Misc Observations
There was no evidence that hundreds of thousands of coins were missing when Roger Ver made the so-called “hostage” video six months ago. If the transaction malleability problem was being used to steal hundreds of thousands of coins from MtGox, it would have had to have been done over the last half year in substantial amounts. There is good reason to believe that whatever cold-storage solution MtGox has developed that there are wallets which may have not been tested for months or years. Very few coins would be required to be in first stage cold or hot wallets in order to run the operation. There is good reason to believe that Mark can fuck up essential code. Depending on the nature of the theoretical wallet bug, it is possible that early tests of public/private pairs were successful, and only later did the wallet software begin producing incorrect private keys.
If MtGox was watching the public addresses of their coldest-cold wallets then they would have had no reason to be concerned, and accounting would have balanced right up until the end.
The transaction malleability thefts likely occurred. But there is little possibility these thefts included many hundreds of thousands of coins and were not noticed over an extended period of time — or that MtGox would not question shifting 99.5% of BTC reserves out of a cold wallet over a short period of time. If this continues to be the story, then it is very likely that Mark is involved in a massive fraud.
Burned Coins
If my theory is basically correct then majority of the coins are either lost forever due to key mismanagement — or they are possibly recoverable. If they are lost forever, I can imagine why Mark would mislead even his close friends out of embarrassment and suggest that all of the coins were stolen. If they are lost forever I can imagine why Mark might delude himself into believing they might be recoverable. If they might be recoverable, I can imagine why Mark would want to keep it private until he recovered them — even parsing words : “Well technically they’re not ‘lost’ just yet, just temporarily unavailable.” If it is likely that they are recoverable, I can imagine why a venture firm would agree to purchase a company in MtGox’s state.
If my theory is basically correct and Mark is hiding this information while he attempts to recover the keys on his own, then Charlie might be able to convince him to allow other people to help.
If the coins are burned and lost forever, then the demise of MtGox is quite a different story for the markets than it is now. Of course it means that there are considerably fewer bitcoins than were assumed to be available for trade a few days ago. Everyone’s coins are that much more scarce.
–
I run a small IRC channel on a home server for some friends, and when I floated this theory to them on Tuesday morning, one of them took the idea to #bitcoin on Freenode. In fact, you probably know my friend. My friend posted a single sentence summary in heavy chat traffic: “What if MtGox simply lost the coins due to an EC bug in their custom wallet implementation?” Within seconds a developer pounced on him with questions: “What is your source?… Who told you this?.. Tell me what you know…” They ended up in private chat where my friend informed the developer that it was just speculation by a friend with no inside knowledge. It turns out that the developer has a friend who has had much the same problem before, and his immediate interest suggests to me that he considers the theory plausible, too. For what it’s worth, I have no coins or fiat stuck at MtGox — nor do I know anyone with anything stuck at Gox.
The theft story just can not account for the totality of the missing funds — and I think that it is much more likely that something like what I have described above is happening. And it is at least possible that if I am correct, and if Mark is hiding this fact, that an intervention could lead to smart professionals recovering private keys and saving the day.
source: http://letstalkbitcoin.com/somethings-not-right-at-gox/
Guugll Search
http://www.guugll.eu/somethings-not-right-at-gox/
No comments:
Post a Comment