The so-called hacking of Japanese Bitcoin exchange Mt. Gox Inc. in 2014 has been thrown into doubt again over the weekend with a new report finding that the coins were stolen over a period well before the alleged hacking of the site.

According to a report from Bitcoin security firm WizSec, most or all of the missing bitcoins were stolen straight out of the Mt. Gox hot wallet over time, beginning in late 2011.

The firm claims to have traced some two million Mt. Gox related Bitcoin addresses, which they confirmed with sources was a more or less complete figure, with the note that there were some gaps in their data in relation to older internal transactions.

That data extrapolated showed that by the end of 2011, there was a clear discrepancy of some several hundred thousand Bitcoins between the expected holdings Mt. Gox should have held and actual holdings. It then gets worse, with the discrepancy growing over time to the point that by the middle of 2013, there were “practically no Bitcoins left” in Mt. Gox.

The short version is that Mt. Gox was insolvent from mid-2013 and continued to trade into 2014 before claiming the Bitcoin was stolen due to the service being hacked.

Missing Bitcoins

WizSec claims in its report that the missing coins from Mt. Gox would suddenly get sent to a new non-Mt. Gox address, without any withdrawal log entry. Later these addresses in turn would get gathered up into bigger address holding of a few thousand Bitcoin. From there, the coins would get deposited in chunks of some hundred Bitcoin at a time onto various bitcoin exchanges, including BTC-e, Bitcoinica, and even Mt. Gox itself.

Yes, some of the missing coins were actually sold back to Mt. Gox.

“This kind of activity would be hard to interpret as anything but intentional theft” the report states.

The news that Mt. Gox was an insider job isn’t new: Japan police alleged the same January 2nd, however this is the first time it has been alleged that the stolen Bitcoin didn’t disappear immediately in the lead up to the Mt. Gox’s collapse in 2014 but had instead been a long-term criminal endeavour.

The concept that the theft had gone on for such a period of time would also indicate that the fraud wasn’t the act of one lone employee, but more likely a criminal conspiracy starting at the very top of Mt. Gox, given the huge discrepancies in their holdings versus what they publicly reported to hold in reserve.

photo credits: Atención via photopin (license)/ WizSec