MtGox Lost 'Barely 386 Bitcoins' Due to Cyber Attacks - Not 850,000

A study carried out by the Swiss Federal Institute of Technology in Zurich has concluded that, at most, MtGox lost 386 bitcoins in cyber attacks trying to take advantage of the transaction malleability flaw inherent in the bitcoin source code - not the 850,000 bitcoins its CEO Mark Karpeles claims.

When MtGox, once the world's biggest bitcoin exchange, collapsed last month it claimed that 850,000 bitcoins had been stolen in a persistent cyber attack which took advantage of a flaw in the bitcoin source code which altered transaction ID information to trick exchanges like MtGox into sending bitcoins to an address without that transaction showing up on the public ledger.

The study, carried out by Christian Decker and Roger Wattenhofer, looks closely at all bitcoin transactions from January of 2013 to February of this year.

While the study concludes that the transaction malleability problem is real however. it goes on to say:

"While MtGox claimed to have lost 850,000 bitcoins due to malleability attacks, we merely observed a total of 302,000 bitcoins ever being involved in malleability attacks. Of these, only 1,811 bitcoins were in attacks before MtGox stopped users from withdrawing bitcoins."

Explain whereabouts of 849,600 bitcoins

The study goes on to point out that of all the attacks carried out, only 21.36% were effective, meaning barely 386 bitcoins could have been stolen using malleability attacks from MtGox or from other businesses.

"Even if all of these attacks were targeted against MtGox, MtGox needs to explain the whereabouts of 849,600 bitcoins."

The report also highlights the fact that transaction malleability has been known about since at least 2010, when it was first documented. Before the MtGox debacle however, it received very little attention and was categorised as a low priority issue.

Under investigation

MtGox is currently under investigation by the police in Japan and a court-appointed administrator in the company's Japan bankruptcy application is due to report this week on a month-long examination, which will determine if the exchange can be rehabilitated or should be liquidated.

The study once again throws into doubt the validity of the claims made by MtGox since it suspended withdrawals from the exchange last month. There have been many claims by customers of the exchange who have lost millions of pounds worth of bitcoin that Karpeles has been lying about what went on at the exchange.

The company last week announced that it had discovered 200,000 bitcoins in a forgotten, old-format wallet which it believed was empty, which could back up reports that the company was not being run properly by Karpeles.

A tweet on Tuesday of this week from Eren Canarslan, a Turkish investment banker who said he had been in touch with Karpeles, suggested MtGox had discovered another 670,000 bitcoins and would announce such "in a few days."

Canarslan has not tweeted since.