In 2013, Mt. Gox was the exchange that all Bitcoin users knew. Having the most liquidity and volume, this is where most Bitcoins were exchanged. Whether it was the transaction malleability exploits, trade withdrawal exploits or the infrastructure is not being able to handle the load, Mt. Gox went to dust, losing 850,000 Bitcoins. In USD equivalent at the time of the collapse, this equated to over $400 million customer funds that were unaccounted for.
Also read: Bitcoin Exchange CAVIRTEX Shut’s Down After Database Hack Leaves User Data Exposed
Many companies and individuals attempted to investigate as well as assist in obtaining lost Bitcoins in any way they could. Kraken was even dubbed the official investigator, aiding Mt. Gox in any way they could. In the last year, follow-up reports have been scant, with Kraken staying silent and mostly speculation and rumors. There was one report back in May regarding Willy, the trading bot that went rampant and manipulated the price of Bitcoin, but besides that new information has been meager.
WizSec, a security firm in Tokyo, has recently released a report on the follow-up of Mt. Gox. WizSec followed up where WillyReport left off, with deeper analysis and research into other areas. From the report, the “stolen Bitcoins” may have been accumulated through two entities: “Willy” and “Markus”.
For those who do not know, Willy was the name for trading bot that performed numerous unusual trading actions to manipulate the price of Bitcoin. Willy was a bot whose trading activity was spread across several user accounts.
Willy followed a pattern of buying an amount of Bitcoin that ranged from 10-20 Bitcoins, with a total of one user purchasing a total of $2.5 million. Once that specific account reached that limit, it was closed, and another was opened hours later and continued the same pattern. The trades were never sell orders, and in total $112 million was spent to accumulate 270,000 Bitcoins between the months of September and November.
Mt. Gox traders also observed Willy purchasing more BTC after November, when the trading log data ends. Willy was expected to accumulate Bitcoin between the months of December and January, and collected another 80,000 BTC for a total of 350,000 Bitcoins from Wally.
Markus, on the other hand, is assumed to be controlled by the same entity. It was active for eight months and became inactive within 7 hours of the first Willy account opening. Markus also shared similar user ID numbers, making the idea of the two being related not a crazy one.
While the exact relationship between the Markus and Willy is unknown, Markus’s trading activity was purportedly linked to the account of CEO Mark Karpeles. The data leaked is inconsistent however, but this may have been intentional to conceal the true identity of the user.
Unlike Willy, Markus did sell occasionally but he paid no fees and seemed to be able to purchase large amounts of Bitcoin without actually spending money. But when Willy sold, the price was correct. Below is a screenshot of the effects Markus had on the market for June 2, the largest recorded sell.
In total, according to the leaked trading logs, Willy and Markus’s total accumulated Bitcoin was around 570,000. Added to the additional 80,000 Bitcoin Willy was said to obtain through the months of December through January you have a total of 650,000 Bitcoin that was bought. If this number is familiar, that is because 650,000 Bitcoins were reported to be lost during the collapse of Bitcoin.
This does not take into factor the 200,000 Bitcoins that were “found” in an old wallet, which would bring the total to 850,000 Bitcoins. While the official story reported is Mt. Gox was suffering from transaction malleability exploits, (maliciously changing transaction details) the data in both The Willy Report and WizSecs report show strong evidence that it could have been an inside job or a total system breach.
While the reports are quite thorough already, there is still plenty of unanswered questions. For example, no data regarding the Willy accounts were ever leaked meaning either the accounts were wiped, emptied, or were fake the whole time. WizSec is still continuing the investigation and should release more information as time passes on.
Original posts: WizSecs Report, The Willy Report
Photo Source: Bitcoin Graph
What do you think of the WizSec report? Do you have Bitcoins in Mt. Gox? What do you think happened to the Bitcoins? Let us know in the comments below!
