$113 Million in Gox Bitcoins Believed To Be Moving Through Blockchain

Large amounts of bitcoins previously handled by Mt Gox, which have lain dormant for years, have started moving on the block chain.

Since the exchange blew up at the end of last month, people have been wondering where the stolen coins went, and have tried to trace some movements between Gox addresses. One participant on the bitcoin talk forum recalled an IRC conversation between Gox CEO Mark Karpeles and various users, which allegedly took place on June 23, 2011.

During their conversation, Karpeles (a.k.a. MagicalTux) offered to demonstrate that the exchange owned large numbers of coins, by sending a uniquely identifiable amount to a given address. He sent 424242.42424242 bitcoins to a specific address beginning with 1eHhgW6vquBY. Sure enough, they showed up.

A few weeks later, that large amount of bitcoins was broken into two smaller amounts. Then, more transactions occurred, peeling off 50,000 bitcoins at a time into separate wallets, possibly as a means of moving them into cold storage.

Most of these 50,000 bitcoin wallets were recombined on 16 November, 2011, into two separate wallets. One of these contained 500,000 bitcoins, while the other contained 50,000.

The 50,000 bitcoin address was created on that date, and was then dormant until July, 2012, when it began receiving small transactions along with several other outputs. However, no coins left that wallet, until today, when its 50,000 bitcoins were sent to another address, as part of outputs from various bitcoin addresses totalling 180,000 bitcoins ($113 million).

Since then, these coins have been rapidly splitting, with coins being subdivided repeatedly. One branch was found to have been splitting every 30 minutes in what appeared to be an automated fashion. This suggests that there may be some code splitting the coins.

We don't know for certain that the 50,000-bitcoin address is indeed owned by Mt Gox, but it seems likely. The other, larger, wallet went through several transactions, with the bulk of the coins being sent to an address that was verified as Mt Gox-owned on the block chain.

The leaked Mt Gox crisis strategy document claims assets of 2,000 bitcoins, contained in a hot wallet, adding that the cold storage had been wiped out.

So, why is this happening now? One explanation is that it makes the coins easier to use for a high volume of transactions. When bitcoins are sent, all the funds held in a particular address are sent, and the 'change' – the part that is surplus to requirements – is sent to a change address, usable by the sender. However, the block chain has to confirm that the change has been returned before it can be reused.

If you were to try and send bitcoins to lots of users very frequently from one address containing a lot of bitcoins, then you would have to wait 10 minutes or more for the block chain to confirm your returned change, before conducting your next transaction.

Core bitcoin developer Gregory Maxwell also suggested that this was a Mt Gox transaction, based on interactions that he had with the Mt Gox API.

Maxwell also argued that the splitting behaviour is consistent with a function in the leaked source code from Mt Gox. This suggests that some of the coins have been dropped into the Mt Gox online wallet, and that the system is now automatically breaking them up, he said.

Money maze image via Shutterstock