MtGox has become a byword for fraud, pain and loss in the bitcoin community. The Tokyo-based exchange, run by an eccentric French émigré named Mark Karpelès, so often locked up users’ funds while providing terse, enigmatic communication – if any – that a verb was coined, used exclusively in the passive: getting “goxxed.” When the exchange declared bankruptcy in February 2014 and it was revealed that 850,000 bitcoin (worth around $480 million at the time and almost $8.5 billion today) had been stolen, goxxing took on a whole new meaning.
Since January 2014, a theory has floated around the internet regarding MtGox’s turbulent final days: that trading bots were manipulating the price of bitcoin on the exchange. In a paper (appendix here) soon to be published in the Journal of Monetary Economics, “Price Manipulation in the Bitcoin Ecosystem,” two economists, Neil Gandal and Tali Oberman of Tel Aviv University, and two computer scientists, JT Hamrick and Tyler Moore of the University of Tulsa, not only confirm the existence of these bots, which was common knowledge – they conclude that 600,000 bitcoin worth of suspicious trading activity, taking place from February to November 2013, “likely caused the unprecedented spike in the USD-BTC exchange rate in late 2013, when the rate jumped from around $150 to more than $1,000 in two months.”
Willy and Markus
On Jan. 5, 2014, paleh0rse posted to the BitcoinMarkets subreddit, “A bot has been buying 10-19 BTC every 6-10 minutes for AT LEAST the last two weeks,” along with a back-of-the-napkin calculation that the bot had picked up at least 20,000 bitcoin. The same user later dubbed the bot Willy, and that May a dedicated WordPress blog called the Willy Report laid out the case for “massive fraudulent trading activity at Mt. Gox” that “enormously” affected bitcoin’s price; the author, Kristian Slabbekoorn, also identified a second, earlier, bot, called Markus. MtGox transaction data leaked in March 2014 fueled further internet sleuthing.
The same leaked data, which encompasses 18 million matching buy and sell transactions from April 2011 to November 2013, enabled Gandal et al. to confirm manipulation by at least 50 bots: the first (which they followed their predecessors in calling Markus) operated from Feb. 14 to Sept. 27, 2013; the other 49 (a cluster of accounts that followed the same trading protocol, collectively called Willy) began operating the same day Markus went offline and continued until the data cut off on Nov. 30, 2013. (See also, How Bitcoin Works.)
Neither account appears to have paid for the bitcoin it bought. Markus “was fraudulently credited with claimed bitcoins that almost certainly were not backed by real coins,” and “no legitimate Mt. Gox customer received the currency Markus supposedly paid to acquire these claimed coins.” The bot did not pay transaction fees either. The authors conclude that the account was fraudulently credited with a balance of 335,898 bitcoin.
Within eight hours of Markus’ retirement, a string of Willys came online. The first bought $2.5 million worth of bitcoin then went inactive, immediately replaced by a clone with a different account ID, and so on for a total of 49 Willy bots. In total they scooped up 268,132 bitcoin. “It appears that Willy was interacting with real users,” the authors write, but “while accounts of these users were ‘nominally’ credited with Fiat currency, Willy likely did not pay for the bitcoins.” Most suspiciously, the bots kept right on buying even during MtGox’s (frequent) trading outages.
That’s No Moon
Presumably, the price of bitcoin on MtGox reflected this onslaught of demand by bots that were not subject to irksome economic constraints such as actually having to pay for their bitcoin. This was indeed the case, the authors find.
Markus and Willy did not trade every day. They took breaks, giving researchers a control with which to contrast bot-days. They find that during Markus’ career, the bot was inactive on 193 days; during that period the price of bitcoin on MtGox increased on 109 days, 56% of the time. When Markus was active (33 days), the price rose 79% of the time. Willy was more diligent, trading on 50 of 65 days; when the bot was trading, the price went up 80% of the time, compared to 40% of the time it was offline. When the bots were trading, they accounted for around 20% of the exchange’s total volume and pushed the price up an average of $20 each day.
The cumulative effect was enormous, and while the bots were only active on MtGox, the price rises spilled over onto other exchanges. CoinDesk’s bitcoin price index was $123.50 on Sept. 27, 2013, the day Markus – whose effect on the price was admittedly not that impressive – passed the torch to the first Willy. When the MtGox leak’s data cut off, on Nov. 30 of that year, the price was $1,124.76, a high it would not hit again until 2017. (See also, This Bitcoin “Bull Market” Is Nothing.)
Bitcoin price, 2013-2017. Source: Gandal, Hamrick, Moore and Oberman.
paleh0rse, the reddit user who first pointed to bot activity on MtGox, disagrees with the paper’s emphasis on Markus and Willy’s role. “This research paper suffers from the same glaring flaw as each of the previous attempts to credit Markus and Willy for the event,” paleh0rse told me via private message. “It completely ignores ‘the China factor.'” While the MtGox bots’ activity played a “minor” role in the 2013 bull market, “it was actually China’s entry and trading activity” that drove bitcoin’s price up.
Slabbekoorn, the author of the Willy Report, sees the paper as “confirmation that the bots were most likely single-handedly responsible for the price rise,” he told me via email. “This was always my suspicion,” he added, “but I had no way to prove it (and it was generally vehemently denied in the Bitcoin community).”
For the Good of the Company
The redditsphere’s early theorizing about these bots revolved around a central question: was it the work of an outside hacker or a MtGox insider?
Based on evidence that’s emerged since, the authors go with a theory first put forward by bitcointalk user Peter R in March 2014: Karpelès was trying to cover for a shortfall, perhaps borne of a 2011 hack. “If Mt. Gox was trying to hide the absence of a huge number of BTC from its coffers,” the authors write, “it could succeed so long as customers remained confident in the exchange. By offering to buy large numbers of bitcoins, Willy could prop up the trading volume at Mt. Gox and ‘convert’ consumer ‘bitcoin’ balances to fiat money.” So long as the bulk of customers left their fiat balances in the exchange, MtGox could stave off the inevitable for a while, Bernie Madoff-style.
According to Kim Nilsson, chief engineer at WizSec, who analyzed the leaked MtGox transaction data, that theory is correct. “There were actually multiple thefts out of MtGox, as far back as the very beginning of 2011,” he told the Breaking Bitcoin conference in Paris in September 2017,
“which means that for almost the entire existence of MtGox, it was insolvent. It didn’t have enough money to ever pay back the people who had deposited. Further, we had proof that after MtGox discovered its first insolvencies, it had started to trade those liabilities on its own exchange. And this is what later became known as the Willy bot, and that it was making up fake funds and trading them around to shift bitcoin debts into dollar debts and vice-versa.”
Karpelès himself confirmed that he operated Willy during his trial in Tokyo in July 2017; he called it an “obligation exchange” and said it, according to an activist who was present at the hearing, the bot was “for the good of company so not illegal.” Karpelès has pled not guilty to charges of embezzlement and data manipulation.
These revelations bear out the suspicions that Gandal et al. expressed in an early version of their paper, written in June 2017: the 604,030 bitcoin Markus and Willy acquired is “very close” to the 650,000 bitcoin MtGox ultimately lost (Karpelès said the company had found 200,000 of the missing 850,000 bitcoin in March 2014).
Things Have Changed … Right?
Bitcoin has largely moved beyond a seedy infancy defined by the likes of MtGox and the Silk Road. The papers’ authors sound a note of caution, however, about a “very opaque and unregulated market” that now includes hosts of other, often thinly traded cryptocurrencies:
“Given the recent meteoric rise in bitcoin to levels beyond the peak 2013 (and the huge increase in the prices of other cryptocurrencies), it is important for the exchanges to ensure that there is not fraudulent trading. The potential for manipulation has grown despite the increase in total market capitalization because there has been a very large increase in the number of cryptocurrencies.”
They add that it may be time for regulators to take a more active role in cryptocurrency exchanges.