The Mt. Gox Collapse: A Digital Asset Custody Case Study

Mt. Gox was once the world's dominant bitcoin exchange, handling around 70% of all bitcoin transactions globally at its peak. Its 2014 collapse — the disappearance of roughly 850,000 bitcoins — remains the case study that shaped how the accounting and finance profession thinks about custody risk, internal controls, and asset verification in the still-young cryptoasset sector.

What happened

Mt. Gox, a Tokyo-based cryptocurrency exchange, suspended trading, closed its website, and filed for bankruptcy protection in February 2014, disclosing that approximately 850,000 bitcoins — belonging to both customers and the exchange itself — had gone missing, worth roughly $500 million at the time. For years, the precise cause was disputed: some suspected the exchange's own operators, while others pointed to external hacking exploiting known weaknesses in Bitcoin's transaction protocols, particularly a flaw known as transaction malleability that made it possible to manipulate transaction records in ways that complicated tracing and reconciliation. Investigators later found that most of the missing bitcoin had, in fact, been stolen gradually over a period of years before the exchange's ultimate collapse, rather than in a single catastrophic breach.

In 2023, US and Japanese investigators formally indicted two Russian nationals, Alexey Bilyuchenko and Aleksandr Verner, alleging they had gained unauthorised access to Mt. Gox's servers and exfiltrated more than 647,000 bitcoins over an extended period — providing, nearly a decade after the collapse, the clearest public account yet of how the theft had actually occurred.

The numbers at a glance

• ~850,000 BTC — total bitcoin that disappeared from Mt. Gox, worth roughly $500 million at the time
• ~70% — approximate share of global bitcoin trading volume Mt. Gox handled at its peak
• February 2014 — month Mt. Gox suspended trading and filed for bankruptcy
• ~647,000 BTC — bitcoin US and Japanese authorities allege two indicted individuals stole via server intrusion

A decade-long, still-unfinished repayment saga

Mt. Gox's bankruptcy and subsequent civil rehabilitation proceedings became a case study in their own right for how astonishingly long crypto-asset insolvency and creditor recovery can take. Roughly 200,000 of the missing bitcoins were eventually recovered and held in cold storage, and creditor repayments — in a mix of bitcoin and bitcoin cash — finally began in 2023, nearly a decade after the collapse. As of late 2025, repayments were still ongoing, with tens of thousands of creditors still waiting in the queue for final distribution, an extraordinary illustration of how complex it can be to value, trace, and distribute a lost cryptoasset pool once genuine legal claims to it are established.

Why this matters for accounting and finance students

Mt. Gox is a foundational case study for anyone studying digital asset custody, internal controls, or cryptoasset accounting, because it exposed a problem that had no clean precedent in traditional finance: what does it actually mean to verify a company's holdings of an asset that exists only as cryptographic entries on a distributed ledger, when the exchange itself controls both the private keys and the reporting of its own reserves? The case is widely cited as the origin point for the "proof of reserves" concept that many crypto exchanges later adopted (with mixed rigour) to demonstrate customer assets are genuinely held 1:1, and it remains a cautionary reference point whenever a crypto platform's internal controls and asset segregation practices come under scrutiny — a pattern that recurred, in different forms, in the FTX collapse nearly a decade later.

Not classic fraud, but a control failure with the same lesson

Unlike many of the cases covered elsewhere in this series, Mt. Gox's leadership was never shown to have deliberately fabricated financial statements or knowingly stolen customer funds in the way Ponzi scheme operators or accounting fraudsters have. Founder Mark Karpelès was ultimately convicted in Japan only on a lesser data manipulation charge, receiving a suspended sentence, and was acquitted of the more serious embezzlement and breach-of-trust charges brought against him. That distinction matters for how the case is taught: Mt. Gox is less a story of deliberate deception and more a story of catastrophically inadequate internal controls and security practices at an institution suddenly responsible for safeguarding billions of dollars of other people's assets — a governance failure rather than a fraud in the traditional sense, but one with financial consequences just as severe.

Frequently asked questions

How much bitcoin disappeared from Mt. Gox?
Approximately 850,000 bitcoins, belonging to both customers and the exchange itself, worth roughly $500 million at the time of the 2014 collapse.

Was the loss due to hacking or internal fraud?
Evidence points primarily to external hacking — 2023 indictments allege two individuals gained unauthorised server access and stole over 647,000 bitcoins over an extended period, though weaknesses in Mt. Gox's own internal controls contributed to the loss going undetected for so long.

Have Mt. Gox creditors been repaid?
Repayments began in 2023, nearly a decade after the collapse, and were still ongoing as of late 2025, with many creditors still awaiting final distribution.

Mt. Gox is a valuable, distinctive case study for ACCA and CIMA coursework on digital asset controls, custody risk, and emerging areas of financial reporting. Learnsignal's CPD courses also cover ongoing cryptoasset and risk training for qualified professionals.