The 850,000 BTC Illusion: Full Ledgers, Empty Wallets, and a Decade-Long Wait

1. A Card-Market Domain Becomes the Busiest Exchange in Bitcoin

Jed McCaleb registered mtgox.com in 2007 for a Magic: The Gathering card market that never took off. In late 2010, he reused the idle domain for a Bitcoin exchange. A spare web address had become an accidental bank.^[1]

McCaleb sold the exchange in 2011 to Mark Karpelès, a French programmer in Japan. As Bitcoin rose from $13 to more than $1,200 during 2013, Mt. Gox became its busiest marketplace. Karpelès owned 88 percent and McCaleb 12 percent, according to a leaked business plan cited by Wired.^[1]

A June 2011 breach drove the displayed price from $17.50 to $0.01 in 30 minutes and exposed user data. Mt. Gox recovered, and its reputation — rather than public proof of reserves — became its real collateral.^[1][9]

By late 2013, federal agents had seized $5 million from a company bank account, CoinLab was suing for $75 million, dollar withdrawals were delayed, and Mt. Gox had fallen from first to third among exchanges. None of these warnings showed whether the wallets still held the coins promised by its database.^[1]

2. The Multi-Year Drain the Dashboard Never Showed

After the collapse, WizSec researchers clustered more than two million addresses they identified as Mt. Gox's and compared them with leaked internal records. Their blockchain reconstruction inverted the public timeline: this was not one February 2014 hack, but a drain that had run for years.^[3]

"Most or all of the missing bitcoins were stolen straight out of the MtGox hot wallet over time, beginning in late 2011."^[3]

— Kim Nilsson (WizSec), 'The Missing MtGox Bitcoins'

According to WizSec, copied private keys began draining the hot wallet in September 2011. The researchers concluded that Mt. Gox was technically insolvent for years and practically out of spendable bitcoin by 2013. The exchange remained busy; its customer database kept displaying balances that its wallets no longer backed.^[3][11]

In February 2014, Mt. Gox halted withdrawals and attributed the disappearance to “abuse of a bug in the bitcoin system.” WizSec’s later reconstruction of a drain beginning in late 2011 was inconsistent with that explanation as the primary cause. The freeze exposed a gap that had already grown for years.^[10][3]

3. Twenty-Eight Days in February

On February 28, 2014, MtGox Co., Ltd. applied for civil rehabilitation in Tokyo and reported that approximately 750,000 customer bitcoins and 100,000 company bitcoins had disappeared. The declared 850,000 BTC shortfall was worth more than $460 million at the time by Wired's estimate; it was not proof of a one-day theft.^[2][1][10]

"We had weaknesses in our system, and our bitcoins vanished. We've caused trouble and inconvenience to many people, and I feel deeply sorry for what has happened."^[1]

— Mark Karpelès, Tokyo press conference, February 28, 2014 (as quoted by Wired)

Seven days later, on March 7, the company found 199,999.99 BTC in an old-format wallet used before June 2011. Announced March 20, the find revised the missing estimate to roughly 650,000 BTC. WizSec later identified those coins as legacy holdings never merged into the drained hot wallets.^[2][3]

The recovery was real and damning. An exchange had lost track of 200,000 BTC for years. The March discovery replaced the image of one sudden heist with a deeper failure: an internal ledger that had drifted far from wallet reality.^[2][3]

4. The Accused and the Convicted

Japan's case against Karpelès ended in a split verdict. After 11 months in pre-trial detention, he was convicted in 2019 of manipulating electronic records and sentenced to two and a half years, suspended for four. He was acquitted of embezzlement. The Tokyo High Court upheld both outcomes in 2020.^[6]

In 2023, U.S. prosecutors alleged that Alexey Bilyuchenko and Aleksandr Verner gained unauthorized access to Mt. Gox wallet infrastructure in September 2011 and caused the theft of approximately 647,000 BTC through at least May 2014. The release stresses that these are accusations and the defendants are presumed innocent.^[4]

Prosecutors also alleged that Bilyuchenko later helped operate BTC-e with Alexander Vinnik. Vinnik pleaded guilty in 2024 to one count of money-laundering conspiracy relating to BTC-e's operation. FinCEN had separately assessed a civil monetary penalty against him and BTC-e over anti-money-laundering failures. Neither action adjudicated responsibility for Mt. Gox.^[4][5]

The opened sources do not establish a final disposition for the 2023 charges. They remain allegations for this story, while WizSec's years-long-drain account remains a private forensic inference. No opened court judgment establishes who committed the Mt. Gox theft.^[4][3]

5. A Decade to Be Repaid in Bitcoin

The money's story outlasted the criminal one. More than ten years after the collapse, under a rehabilitation plan that finally allowed the estate to repay in kind, the payouts began: across July and August 2024 and January through March 2025, the rehabilitation trustee paid over 19,500 creditors in Bitcoin and Bitcoin Cash through designated cryptocurrency exchanges, alongside cash repayments funded by earlier coin sales. The wait was cruel; the asset was patient. Claims were born in a collapse that valued the missing coins at more than $460 million. Mt. Gox then held about 202,000 BTC in total—about 200,000 newly found plus about 2,000 already known—against an estimated 650,000 BTC still missing. Partial, however, is the operative word: the plan distributed what the estate held, not what customers had lost.^[7][2][1]

"the Rehabilitation Trustee has largely completed the Base Repayment, Early Lump-Sum Repayment, and Intermediate Repayment"^[8]

— Nobuaki Kobayashi, rehabilitation trustee, notice of October 27, 2025

Largely completed is a precisely engineered phrase. The October 27, 2025 notice says the specified repayments were largely completed for creditors who had finished the required procedures and encountered no issues — and, in the same breath, that many creditors had yet to complete their procedures or had run into problems during payment. For them, the deadline was extended from October 31, 2025 to October 31, 2026, Japan Standard Time. That is the latest official word: more than 19,500 creditors paid, an unknown remainder still waiting, and a distribution that is substantial without being total.^[8][7]

The durable lesson is an accounting rule, not an investment thesis. A balance on an exchange is a row in somebody else's database, and the blockchain is the only auditor that works weekends. Custody without continuous reconciliation is not custody at all; it is a story a company tells itself until the withdrawals stop. WizSec's researchers closed their first Mt. Gox report with an admonition addressed to every exchange since —^[3]

"A reminder to all bitcoin businesses out there: Always. Monitor. Your. Bitcoins."^[3]

— Kim Nilsson (WizSec)