July 27, 2017

Breaking open the MtGox case, part 1

Earlier today news broke of an arrest in Greece of a Russian national suspected of running a large-scale money laundering operation focused on Bitcoin. The man has since been publicly identified as Alexander Vinnik, 38, and over $4 billion USD is said to have been trafficked through the operation since 2011.

We won't beat around the bush with it: Vinnik is our chief suspect for involvement in the MtGox theft (or the laundering of the proceeds thereof). This is the result of years of patient work, and these findings were surely independently uncovered by other investigators as well. Everyone who worked on the case have patiently kept quiet while forwarding findings to law enforcement, so as not to tip suspects off and to maximize the chances of arrests.

With such an arrest actually happening, we think today might — finally — be the day when we can begin talking about what we've actually been doing all this time and what we found. Thank you for your patience.


July 12, 2017

Comments on the Mark Karpelès trial

July 11 was the first day of proceedings for the anticipated trial of Mark Karpelès, CEO of the bankrupt MtGox bitcoin exchange. Karpelès was charged with creation and manipulation of private electronic records, as well as embezzlement of customer funds, or embezzlement of company funds, or breach of trust, in that order.

I was present in the courtroom for the entire first day, and I expect there will be a lot of interpretations and extrapolations based on the limited early information that will no doubt circulate online and in the media, so I will attempt to flesh out and explain what is actually going on through some brief commentary.

April 19, 2015

The missing MtGox bitcoins

We received a lot of positive feedback on our release of our preliminary investigation into the Willy bot, even though it was already quite old (written circa August 2014). We also said we hoped to release more of our information over time, even though we have to take some care doing so. But while we have good relations to responsibly acquire and exchange information and share efforts, and reception from people online has been very encouraging, official interest has been pretty low.

In recent weeks, there has been a lot of news surrounding the U.S. agents accused of large bitcoin thefts in early 2013, and their interactions with Silk Road as well as MtGox. In the wake of this, there has been intense speculation that what happened at MtGox may have been related to these agents.

With the next creditors' meeting also on the horizon, this seems like a pretty good time for me to step in and share a bit more of what we know. First of all: no, we don't think these agents are main characters in the story of the missing MtGox bitcoins, and the story doesn't begin in 2013 either.

February 14, 2015

MtGox investigation update and preliminary release

WizSec has been investigating the MtGox crash since soon after it occurred, making us probably the longest running non-official investigation. In this time, as we slowly discover more things, it has become more and more important to be careful in what we disclose, both in order not to jeopardize other investigations and also not to needlessly get any of our sources into trouble. In line with our intent to investigate responsibly, we have also signed several non-disclosure agreements.

However, it has now been a full year since MtGox, and the then customers, now creditors still don't have much to go on. There was the release of The Willy Report last May, then there was the encouraging news that Kraken was appointed as an additional official investigator in November (but as such they will also have to work mostly in silence), and later we heard speculations of MtGox involvement being tossed around in the Silk Road trial.

We wanted to share at least something publicly to help keep attention on MtGox alive, and after some consideration we think the following information is "safe" without betraying any trust or causing any trouble. This is an adaptation of a report we prepared last summer, documenting one of the things we focused on early in the investigation: a deeper look into the activities of the Willy trading bot. This is information we've already shared with official investigators and is not too sensitive, as it represents an early stage of our investigation.