Lessons from the Mt. Gox Hack - 850,000 Bitcoins Stolen Mt. Gox was a bitcoin exchange based in Shibuya, Tokyo, Japan.
Launched in July 2010, by 2013 and into 2014 it was handling over 70%
of all bitcoin (BTC) transactions worldwide, as the largest bitcoin
intermediary and the world's leading bitcoin exchange.


Mt. Gox announced that approximately 850,000 bitcoins belonging to
customers and the company were missing and likely stolen, an amount
valued at more than $450 million at the time

Today that amount of Bitcoin would be worth nearly $40 billion dollars (depending on the day of the week).
Reading the above makes me concerned. If the world's (once) largest exchange was unable to prevent a hack of this magnitude, how can any exchange (without a multi million dollar security budget) be reasonably certain that hack like this won't effect them?
Is there a consensus (or at least a plausible theory) as to what went wrong on the technical side that allowed such a large exchange to be hacked? What practical lessons can one learn from this story in terms of securing their users funds?
Is there a consensus (or at least a plausible theory) as to what went wrong on the technical side that allowed such a large exchange to be hacked?

Independent Investigation related to Mt. Gox by Kim Nilsson: https://youtu.be/l70iRcSxqzo (Breaking Bitcoin Conference 2017)
Summary of the presentation:

There were multiple thefts since 2011

Mt. Gox was insolvent for most of it's existence

Traded it's own liabilities on Mt. Gox exchange

Connected to other bitcoin thefts

Alexander Vinnik arrested in 2017, received over half a million bitcoin from Mt. Gox and other bitcoin thefts, deposted bitcoin to BTC-e, TradeHill, Mt. Gox and alleged by US to be a BTC-e administrator

He didn't use any bitcoin mixers, did UTXO consolidation few times, deposited bitcoin back to Mt. Gox and Used his real name online to complain about his stolen funds being confiscated

All evidence pointing to Vinnik are for the wallets that receive and move the stolen bitcoin. The thief had possession of Mt Gox's private keys, could have sent bitcoin anywhere. Unlikely a single person carried out these many thefts.

Private keys were most likely stolen. Running a second bitcoin wallet on top of a copied wallet.dat file leaves blockchain fingerprint. 100 private keys are pre generated in Bitcoin Core wallet using keypool.

First 100 theft transactions have change addresses perfectly matching Mt Gox's keypool as of September 11, 2011

Some of those addresses were allocated as deposit address on Mt Gox

Thief steals bitcoin and Mt. Gox identifies change as deposit.

Things hacked in 2011: Hot wallet with upto 100,000 keys

Theft pattern: Each transaction steals similar amounts, longer and longer time between transactions and restarts with same stolen wallet.dat file.

Incidents: Liberty Reserve Withdrawal Exploit 2011 (XML injection), Liberty Reserve Withdrawal Exploit #2 2011 (negative amount used for withdrawal resulted in deposit), Hot wallet stolen in 2011 (80,000 BTC), Public hack via compromised accounts in June 2011 (2000 BTC), Compromised database in September 2011 (77,500 BTC), Hot wallet stolen again (Sep-Oct 2011) involving 630,000 BTC, Incorrectly detected deposits (30,000 BTC), Accidentally destroyed bitcoin due to bug in new bitcoin wallet(2609 BTC), Willy (28,000 BTC)



What practical lessons can one learn from this story in terms of securing their users funds?


Exchanges should hire competent developers to manage funds and use multisig which many already do right now

Use latest bitcoin technologies and follow best practices

Keep most of the funds in cold storage, some amount in hot wallets to manage deposit and withdrawals.

Do not trade with users funds and be transparent about everything

Users should avoid centralized KYC exchanges and use DEX or trust minimized exchanges like Bisq, HodlHodl, Localcryptos, Sovryn, OpenDEX, TDEX etc.

Developers should focus on better key management, trust minimized exchanges and layer 2

Developers should improve privacy in Bitcoin and Users should follow the best practices like : No KYC, No address reuse, Coinjoin, Payjoin, Full node, Do not share information about transactions on social media etc.