--

I just saw this also in ##mtgox-chat.

What legitimized this was the fact there was a portion where MtGox connected to Eligius's servers to broadcast free transactions.

Eligius and MtGox had a partnership where MtGox provided free hosting for their pool in return for their acceptance of MtGox's transactions with no charge.

What legitimized this was the fact there was a portion where MtGox connected to Eligius's servers to broadcast free transactions.

Eligius and MtGox had a partnership where MtGox provided free hosting for their pool in return for their acceptance of MtGox's transactions with no charge.

This was a massive fuck up by MtGox, but I really do feel sorry for Mark Karpeles. He seemed really enthusiastic about Bitcoin. Right by MtGox's offices in Japan was a Bitcoin Cafe being built. You can [see here](http://si.wsj.net/public/resources/images/BN-BS458_mtgox0_G_...) the sign of a Bitcoin logo waiting to be unraveled.

Bigger than all the victims (no pun intended) was Mark himself. He lost more Bitcoins than any of us, and it's likely he'll be going to jail. Not to mention the death threats he has and will be receiving.

--

One of the (features?) of Bitcoin is its inherent irreversibility. You only have one chance to get things right. Combined with Murphy's Law, something like this was bound to happen.

I've been a Bitcoin enthusiast and have been mining since early 2011, and Bitcoin has been a huge part of my life, but I will admit my confidence in Bitcoin ever _practically_ succeeding has diminished a little.

I tried to withdraw a couple hundred at the start of January into a US bank account and I'm curious if I'll ever get it. It's a very small amount of money (and I paid even less to get the BTC originally), so it's not a big deal at all if I lose it all but I'd still like to get it.

Sorry for your loss. Why didn't you move it to an interest-bearing bank account?

Withdrawals have been massively delayed for at least 6 months.

The smart thing to do was to withdraw bitcoins to another exchange while you still could

he should have transferred the bitcoins to bitstamp when transfers worked and cashed out.

I wish I had hindsight like you.

It was only up until these few months that Bitstamp became of any competition to MtGox. Its liquidity sucked, which was why many early adopters like me stayed.

I'm only making this comment because you used the term "hindsight".

Let me first start off by saying I feel very, very sorry for all the people who lost funds in MtGox. It'll take awhile before you get over the pain of losing a life-changing amount of money. But let's be very clear about this; hindsight wasn't needed here. The warning signs that MtGox was a house of cards became visible a long time ago. Definitely before the disabling of BTC-transfers. A lesson should have been learned here and nothing like this should happen to you again.

-- http://www.livetradingnews.com/the-bitcoin-tangle-were-warni...

"Some signs of a strain were visible early on. The exchange was quick to accept purchases but slow in giving them back. Additional proofs were asked for. The site also had technical issues; some users complained that passwords were displayed in plain text. Users are now left wondering if the small hints portrayed deeper crises."

The complaint that passwords were displayed in plain text is not anywhere near recent. Even in 2011 when I started using MtGox, passwords were hashed. Granted, early on the passwords were only hashed with 1 pass of SHA256, but later on passwords were stored to much better standards.

How do I know this? Because they got hacked twice in 2011, both through SQL vulns. Once a database dump being leaked, and another time a user's account balance was changed and the attacker cleared the bid side of the market book. Trades were rolled back, and MtGox took the loss; nothing remote of this severity ever happened again.

Another thing I do remember [is this](http://imgur.com/xMeW43a), and it seems much more aligned to what the article is talking about. But seriously, look at the URL. The only issue is when someone looks at that user's browsing history, but even this wasn't an issue in 2011.

--

Banking problems were not apparent until last year. It was well understood that banks and Bitcoin exchanges had harsh relationships. Bitfloor, the most popular US-based exchange was shut down due to banking problems; they were unable to find any banking partner that were willing to accept them. MtGox having delays in fiat withdrawals were understandable since it was by far the biggest exchange.

--

Most people who call us idiots for not connecting the dots earlier are those who haven't been here long enough. For many of us, MtGox went down over the years but all to recover. Both Luke-Jr and gmaxwell (core dev) had a significant sum of coins stored on MtGox too. It shows the trust we had in MtGox over the years.

--

One last thing though, is that I will attribute Bitstamp's late popularity causing them to dodge a bullet. The reason MtGox had written their own bitcoin implementation was because the bitcoin reference client was unable to handle their volume of Bitcoin transactions at the time.

Transaction malleability was documented, but not well known issue for Bitcoin. Even the reference Bitcoin client was affected.

So the fatal flaw that MtGox's implementation made when resending transactions (because a different transaction id was accepted and their system did not see it) was it did not reuse the same inputs when resending the transaction.

In the reference bitcoin client (bitcoind), it makes sure to use at least one of the same coin inputs, so if the original transaction (but different tx id) did get accepted into the network, the client would attempt to resend using the same input, but it would get rejected by the network because it was a double spend.

I've been a spectator for quite a few years and after their first hack I was out of MtGox. It was tempting to go back, but time-and-time again they proved their incompetence to a degree that I was not going to risk my holdings. They are amateurs and I have my doubts as to whether they've properly applied any knowledge they've gained over the years.

I've tested withdrawal on MtGox every three years, to see and experience their current liquidity: Getting out Euro's was easy: getting out BTC has never been a problem. Probably them being my three-monthly-test, only a few hundred Euro or a fraction of a Coin at most, made it go through just fine.

Yes, there were apparent problems, and yes, these were highlighted everywhere. But in that case: with very little searching you'll read about people having problems bitstamp, kraken, btc-e, and whatnot.

This is a confusing market; one that requires you to keep a keen eye on the social-workings of some niche-forum, a reddit-community and a blogosphere around all that. In that sense, it might not be hindsight, no. But in that sense, /any/ problem was predicted. By someone. On some Forum. Or Blog. Or reddit-self.post.

But perhaps I'm taking for granted my tech-knowledge(or bias opinion). Let me say some things that jumped out at me immediately as mistakes that should have never happened to begin with when making an application dealing with people's money.

---The password in URL thing.

The issue with that password in browser's history is that it becomes an easy target for malware. Just like there's malware that knows the default location of wallet.dat, malware that scrubs your web history will find it. Making it worse is the fact that there are already a lot of malware that hijack browsers and monitor where it's going. At least wallet.dat can have a passphrase. Then you have those tools that are designed to help end-users by keeping their web history synced with other computers and/or devices. In short, web history is constantly exposed to 3rd parties so no personal info should end up there since you don't know how secure the 3rd parties are handling your data. At least, not passwords, SSN, etc. Another thing is servers tend to keep urls in access.log which tend not to get the same level of security consideration as the rest of the webapp. They should have sent it in POST body which isn't stored in access.log(at least not by default).

----The password hashing thing

Security 101; you don't just hash passwords once with no salt. Existence of rainbow-tables make that insecure and even a novice should have known that before starting. Also, according to this article[1] it was a "saltless MD5"[2?] hash.

----SQL vuln

I don't claim to be a DB expert but I do know using stored-procedures, instead of concatenating a bunch of strings together partially from user-input to form an SQL statement, makes SQL injection nearly impossible. I also believe there are some nice SQL sanitation libraries out there. But I can't judge this too hard because I don't know exactly where the SQL injection happened. Sometimes hackers do something really clever and put the malicious SQL in a place that's not normally user-input; like a cookie value for an authtoken.

----Trades roll back

I did not see that solution as a valid way to do things. I still don't fully understand how that didn't screw over all kinds of people. Can etrade.com decide to roll back 1 day of activity?

I dunno; all these things put together just gave me the feeling that one day these guys would be in trouble. The right thing to do after first, or at least 2nd, hack was a full audit of their whole system by someone who knows about these things. They just didn't show any signs of learning from their mistakes. e.g., like the postmortems that other companies sometimes post up detailing the problem and steps to recover. MtGox seemed to just be reactionary and only enough to solve the immediate problem. I'd advise anyone going forward that if you see similar behavior in anything you deal with, not just bitcoin-related, you run away. Also, a red-flag for me is any system where it's easy to put money into but hard to get out without a very sensible reason.

1. http://www.dailytech.com/The+Death+of+Bitcoins+Mt+Gox/articl...

2. This article claims there was a salt... http://www.dailytech.com/Inside+the+MegaHack+of+Bitcoin+the+...

Just like the handful of people who realized that the Bernie Madoff claims were too good to possibly be true, they didn't need hindsight. There's a great This American Life story about one such person: http://www.thisamericanlife.org/radio-archives/episode/376/w...

It's the biggest load of hypocrisy that people who enthusiastically wanted to play in the libertarian paradise of an unregulated currency think they should be able to turn around and request the help of the regular, regulated, tax-supported economy to make them partial or whole.

First, we'll crap a bunch of processing resources into thin air, ponzi up value in the system, scream self-righteous screeds to the nay-sayers... then, when it goes to shit, call in the cops you were giving the finger to a second ago.

You took your chances. You relished in the freedom of the risk. You eat your pudding.

If they want a bailout, ie a cash injection, then I'm with you.

So, they are essentially saying "We need bitcoin because we don't want to trust institutions like MtGox because they might fail" and you say "They are hypocritical because the failure that they are warning us about and that they suggest a solution to did indeed happen". You have a strange definition of hypocrisy.

OTOH, it should be also clear that there is a problem with the pro-bitcoin argument here, as bitcoin hasn't yet solved the need for instititutions like exchanges. Which shouldn't be surprising, as the thing that bitcoin directly decentralizes (transaction validation and currency issuance) aren't the functions that exchanges serve.

Apart from allowing you to find someone to trade with, validating the actual trade/settling the trade is an important part of an exchange as well, and those at least in principle could be solved using bitcoin-based technology.

And also, bitcoin at least partially could "solve" the problem by just not requiring the use of an exchange anymore once it has sufficient adoption. After all, most people don't directly need an exchange in order to use their local currency either.

And finally, there are suggestions how an exchange could prove its BTC liquidity using the bitcoin system, which would also solve at least part of the abuse potential of a centralized institution.

But yeah, it's not fully solved (yet?) and I simplified things a bit, but I think nothing that has any impact on my argument.

>And that presuming that people with money in MtGox were Bitcoin proponents is not a giant stretch.

It is a giant stretch given that most people who knew a lot about bitcoin and the bitcoin economy, the proponents of bitcoin as it were, have had concerns over mtgox for quite some time. Actually I imagine many people who lost btc and/or fiat at mtgox were relative newcomers who were unaware of the ongoing problems and just saw mtgox as the largest exchange and most public facing one at that. So you are making a huge assumption on which you base your choice to condemn people for their choice.

There have been plenty of these sorts of comments all over the internet since mtgox collapsed,essentially saying:

"champion that it is not regulated, go running to the regulators when a problem arises"

the thing is that never has any one of these comments been followed up with an example or instance where the same person has espoused both beliefs/statements. This is generally because they dont exist and/or the commenter doesnt want to do any work to prove their point they just want to denigrate people they think they are smarter than. An exercise in self-pomposity essentially.

Their argument is that the decentralized nature of bitcoin allows an individual to secure their bitcoin balance without having to rely on any particular institution, which means one can avoid the risks associated with corrupt or otherwise potentially not trustworthy institutions.

Now, this argument obviously does not apply to MtGox - MtGox obviously was/is a centralized company that also obviously has all the risks associated with such a centralized company, and also all the institutional controllability of a centralized company, it's registered in Tokyo, it falls under Japanese jurisdiction, the state could easily have frozen balances people held with them, be it in bitcoin or in USD or EUR or JPY or whatever, ... in short: It is pretty much a Japanese bank, which incidentally allowed trading and storing bitcoin with them. As such, why is it hypocrisy to expect it to be treated like a bank? You have all the risks of using a bank, why not the advantages of using a bank?

But also: Well, even if this was about some stealing someone else's bitcoins (well, it kindof is, as far as MtGox itself is concerned, at least if they are to be believed): Why would it be hypocritical to ask for help from others just because you tried to minimize the need for such help and this also caused the help that you need in the end to be a bit harder to provide? It might even still be an overall benefit to society.

I guess that you might disagree with some of the supposed benefits that proponents of bitcoin claim - but that does not make them hypocritical, just possibly wrong, and it would probably be more constructive to point out where you think their idea will fail in reality or where you disagree with their goals than to accuse them of being hypocritical.

Yes, people used the bank called MtGox in order to bet on the future of bitcoin, just as they use other banks in order to buy stocks of companies in order to bet on their future, often without having a clearly formed view on what the company will be doing in the future, and more often than not with the hope that some particular company will disrupt how a certain business is being done, sometimes even some financial business. That's what we generally call financial capitalism. Just because you are betting on some not fully determined future does not make it a tulip bulb bubble.

Also, "independence from regulation" is not about "not paying taxes" or "not helping other people" or whatever your preconceptions might be, it is about achieving the same things that regulation is supposed to achieve, just without regulation. One major purpose of regulation is to make sure that a bank that you put your money in does not do overly risky things with your money so that you can be sure your money is still there when you need it. The value proposition of bitcoin is that the nature of the technology prevents the abuses in the first place, so there is no bank that could possibly do risky things with your money, so there is no need for regulation in order to keep it safe. Bitcoin proponents are not necessarily "against regulation", but rather "for a better alternative to regulation where there is one". Hence, it's not inconsistent at all, let alone hypocritical, that they expect to make use of the advantages of regulation where it is needed - such as the MtGox bank, which is not bitcoin, and thus does not provide the technical protection promoted by bitcoin proponents, and has to rely on regulation instead.

By the way, are you possibly confusing regulatory protection from bank failure with some kind of protection against a failed investment? If at all, this is about recovering the balances people held with the MtGox bank, not about reimbursing them for money they lost because they invested in bitcoin - it's just like when any other bank fails, really: If you buy IBM shares through your bank, you might expect that the financial industry as a whole would make sure that those shares really are there and you can transfer your shares to a different bank when your bank fails, even if those happen to be shares of a competing bank - but if IBM went bust, you obviously would not expect to be able to recover the money you paid for the shares from anyone, that's your investment risk.

And no, just because you promote some way of doing something does not make it hypocritical when you don't actually do it. Just look up the definition, it just isn't. Hypocrisy is when you claim to be doing something which you actually are not. Plus, there isn't even any inconsistency - when you bet on a technology that would make regulation unnecessary in the future, why should that mean that you should not make use of regulation where it actually is necessary?

The people I think are likely hypocrites are the group I think of "glibertarians". A fine example is Wall Street and its army of fluffers. They are deeply opposed to government intervention, except suddenly when government intervention is in their favor that's ok. It's not libertarianism; it's IGMFY wearing a bow tie.

Also, a writing protip: basing an argument on a dictionary definition is an almost universal sign of a weak argument. It means you've given up trying to engage with what other people are actually saying, and are just trying to "win".

And it's even worse when you're just wrong. If I type "hypocrisy" into Google, the first definition is "the practice of claiming to have moral standards or beliefs to which one's own behavior does not conform; pretense." E.g., the advocacy of (or betting on) independence from or the obsolescence of existing regulatory structures and then turning around and asking for protection from those structures.

And a writing meta protip: Attacking the form of your opponent's argument instead of the content is a universal sign of a weak argument, too.

Also, you better should not confuse "basing an argument on a dictionary definition" with "pointing out that the conclusion of your argument only works because your definition is flawed". Your argument is based on the implicit premise that hypocrisy is generally considered bad. There are reasons why hypocrisy is generally considered bad. Those reasons depend on the common definition. Now, you are using a definition that differs from that common definition in a way which happens to invalidate the reasoning that leads to hypocrisy being considered bad. So, when I am pointing out that you are not using the commonly understood definition, I am doing that because it invalidates your implied conclusion that MtGox users asking for regulatory help are/would be behaving badly.

Advocating for something but doing something else is not hypocrisy (and in particular is not necessarily bad, which is why it is important to point out that it is not hypocrisy), not even by the definition you quoted.

You have to distinguish between someone suggesting to change some common behaviour because that would supposedly be beneficial and someone claiming that they have actually changed their behaviour. If someone just says that they think doing X would be good without claiming or implying to be doing X, there is no pretense. It is perfectly normal to consider some behaviour better than one's own and even advocating for it without it being one's moral standard, for all kinds of reasons, often having to do with the practical impossibility of (completely) changing one's own behaviour unless the suggested better behaviour reaches some critical mass of supporters.

For example, someone could be convinced that only traveling by train would be better than using a car (for whatever reasons). Now, in order to achieve that everyone travels only by train, he starts advocating for train travel. But unfortunately, the rail network is in bad shape and it really is currently impossible to travel by train only. That's why he still has a car and uses it where necessary. The point is that he advocates for train travel and against cars, but his moral standard is not that one only should be traveling by train right now - his moral standard is just that one should advocate for train travel in order to enable the transition away from cars to trains and that one should be using trains where it's easy enough to do so, and that is in complete agreement with what he actually does, he doesn't claim to only be traveling by train, he doesn't judge you for using your car, he only judges you by whether you advocate for trains and maybe whether you use trains where that is practicable. That's obviously the only way that could possibly lead to the idea gaining critical mass so that a better rail network could be built and thus it could become realistic for people to actually travel by train only - it's completely idiotic to expect this person to essentially stop travelling at all until a good rail network exists just because he suggests that that would be a better thing to do, or to suggest that he'd be hypocritical if he expected to be rescued if he had a car accident.

If your moral standard is that one should advocate for the use of bitcoins, and you state that one should advocate for the use of bitcoin, and you do indeed advocate for the use of bitcoins, then you do behave according to the moral standards you claim to have, that's why it's not hypocritical, no matter whether you also do use bitcoins or not.

Only if you claimed that your moral standard was that one should not be using any currencies besides bitcoin right now (so, you would judge people for using USD, for example) but were actually using USD, then that would be hypocrisy.

The reason why that distinction is important is that hypocrisy is considered to be bad because it is a form of deceit (and then there are deeper reasons why deceit is considered to be bad). But just saying that you would consider some behaviour to be better ("advocating for it") without claiming or implying to be behaving in that way is not deceitful, hence not hypocrisy, and hence not necessarily bad.

The fallacy says that an idealist is hypocritical for using real-world resources which wouldn't exist in his ideal world.

It says a communist is hypocritical for wearing shoes made by private enterprise, and a libertarian is hypocritical for buying liquor at the state liquor store, in a state which has that system.

It ignores the issue of bootstrapping. Those who dream of the future must necessarily exist in the present and use the resources of the present.

If (and I'm not persuaded of this) some BitCoiners want a future without regulators, they presumably want some other mechanism to replace regulators, just as the communist wants a people's shoe factory to replace the capitalist shoe factory.

Luckily I have realized my gains which means I can deduct $3k every year in losses with infinite rollover.

If you realized your gains in 2013, you actually owe taxes on $500,000 for your 2013 taxes, which is roughly $250k.

I believe your losses due to bank insolvency will apply to your income for 2014. But you may be on the hook for $250,000 in income taxes this year. But it probably won't offset your tax liability from 2013.

And the state of NYC subpoenaed MtGox's records so they may share this with the IRS.

I would consult a CPA if I were you, you could have a huge tax liability with no adequate way to offset it.

Talk to a CPA. This is the sort of thing they live for.

If it is not a technical problem, and is rather a Ponzi Scheme, the tax implications may be much different since there are IRS rules that handle Ponzi Schemes. Additionally, those that gained profits in the exchange may be required to pay back those profits to victims through clawback lawsuits+.

This IRS link below is a brief overview of how victims of Ponzi Schemes are treated. The most important piece of information is that there is a real chance of a clawback for the people who withdrew and currently think they made money.

http://www.irs.gov/uac/Help-for-Victims-of-Ponzi-Investment-...

I don't have time to read these documents this morning, but I do know that the people who received returns from Madoff are now the focus of lawsuits.

Here is a Forbes article on the subject, there are plenty more you can read out there as well: http://www.forbes.com/sites/jordanmaglich/2012/10/23/ponzi-s...

Here is one example of a hospital having to pay a Clawback. http://www.jewishpress.com/news/breaking-news/hadassah-docto...

+My guess is that the clawback lawsuits would yield very little real money since much of the value of Bitcoined gained was due to price appreciation which may keep lawsuits against those who gained fairly minimal since there isn't much money for lawyers to sue for in complex litigation.

http://en.wikipedia.org/wiki/List_of_Ponzi_schemes

The fact that it doesn't fit the wiki or generally accepted definition of a Ponzi Scheme does not rule out the possibility that it still may be considered one but after spending some more time considering it, it does not look like a true Ponzi Scheme, even if the CEO did directly steal the money and use new money to pay old BTC buyers.

Suppose MtGox wasn't a bitcoin exchange, but rather sold cars, which had to be ordered and paid for in advance. Now, suppose further that the CEO "stole" cars from the company and then bought new ones using the money from new customers when he needed to deliver a car to one of the earlier customers. That's just plain old fraud, not a ponzi scheme, and it doesn't become a ponzi scheme just because it's money instead of cars - and in particular, you as an earlier customer certainly are not liable for the losses of later customers.

edit: I mean, MtGox under the assumption that the loss was not due to a technical problem, if it way due to a technical problem, it's obviously not a ponzi scheme anyway.

Madoff did not say "give me your money and you'll later get back the exact same amount, just minus some fees", I suppose? But that's what MtGox did - there was just no investment aspect to it.

It's like confusing eBay and paypal with some eBay seller: eBay and paypal don't sell clothes, say, they only help you find someone selling clothes and then (optionally) help with the settlement, the payment in particular.

And that's not just a formal distinction: On an exchange (like MtGox or any foreign currency exchange or stock exchange ...), the price for the traded commodity is not set by the exchange, but by the traders using the exchange. The exchange only sets the price for its service of connecting you with a counterparty, but the price for the stocks or bitcoins or whatever sold through the exchange is set by the trading partners, and the exchange also never takes on any of the investment risk, when you sell stocks, the counterparty gets the stocks, you get the money they paid, the exchange only does the bookkeeping.

So any time between you selling bitcoins and actually getting the cleared funds out of an exchange leaves you with the risk of a fairly serious tax liability if the exchange can't actually give you the kind of currency you can pay tax bills with...

[I've had very close calls with seemingly small matters introducing potentially horrific tax liabilities so I am a bit oversensitive to these things!]

Poorly timed realizations of capital gains used to routinely bankrupt people in the startup community, which is why that 83(b) election paperwork is actually really important.

Just a friendly reminder if someone is reading this - you have 30 days to claim 83(b) after you offer yourself shares in your business, otherwise you'll be in a heap of legal/tax issues that can be quite painful (i.e. cost a lot). Make sure you bring this up with your accountant/lawyer.

During the dotcom boom, many, many people faced tremendous tax liabilities because of ill-timed tax strategies. For example, they had stock options that were worth millions, but instead of selling them, they exercised them in order to hold them to get long term capital gains. So for example, they had options worth $10M, and they exercised them. They faced an immediate tax liability for $10M, but then the dotcom bust hit, and they lost all $10M, leaving them with $10M in taxes but nothing to pay it back with. I personally knew several coworkers that suffered this.

I believe it was only recently, over 10 years after the fact, that the IRS changed how they treated this so that people didn't go bankrupt from this.

Pretty ghastly situation to be in if you do end up with a tax liability because of something like this.

Fortunately I did not keep everything in MtGox. If it turns out that I do owe $250k in taxes, I won't be in trouble.

Thanks.

It sounds like you have little to complain about really. it sucks you lost half a million dollars, but if you're not upset about the possibility of losing a quarter more I imagine you're probably set for life as it is.

> [...] I really do feel sorry for Mark Karpeles.

So, it didn't seem that complaining was the main point.

How do you not notice a leak of 850,000 BTC?

How do you not have most of it in cold storage?

How do you not have all kinds of alert systems warning you about even a 500 BTC discrepancy, let alone hundreds of thousands?

You have to get crypto exactly right.

Bitcoin sits on top of both of those sharp pyramids.

Yesterday someone on HackerNews compared a Bitcoin account to a pressurized system where the slightest failure means you lose everything irretrievably and instantly which is a great analogy.

You don't need Good Enough for this. You need Perfect for this.

This represents more than half of my Bitcoin ventures, but fortunately I was able to afford this loss.