Alexander Vinnik, a Russian national, was arrested on vacation in northern Greece on July 25, 20179. At 17:50 UTC on July 26, 2017, the WizSec blog in Japan named him as its chief suspect12. “We won't beat around the bush with it: Vinnik is our chief suspect for involvement in the MtGox theft (or the laundering of the proceeds thereof),” the post said. Kim Nilsson signed it. WizSec describes its research as a voluntary effort.
Nilsson had been tracing the bitcoin lost at Mt. Gox for years. Mt. Gox was the biggest crypto exchange from 2010 to 2013, The Record reported11. This piece follows his paper trail, the numbers behind it, and the charges that came after.
The numbers Mt. Gox gave
Mt. Gox applied to start a civil rehabilitation, a court-run restructuring, in Tokyo on February 28, 20144. Its filing said about 750,000 bitcoins deposited by users and about 100,000 of its own had disappeared. Mt. Gox blamed “illegal access through the abuse of a bug in the bitcoin system” at the start of February 2014.
The count changed on March 20, 2014. That day the company said it had found 199,999.99 bitcoins in an old wallet it used before June 20115. About 650,000 bitcoins were still missing, by its own estimate.
Both sides, in their own words
Did his tracing change who answers for an exchange hack?
“This action should be a strong deterrent to anyone who thinks that they can facilitate ransomware, dark net drug sales, or conduct other illicit activity using encrypted virtual currency”
“There was no French investigation. The Americans said: it's Vinnik… and said: 'make sure he is being transferred to the U.S.,'”
What Nilsson found in 2015
Nilsson published his findings on April 19, 20153. WizSec built a list of over 2 million Mt. Gox addresses. The team matched leaked deposit and withdrawal logs to the blockchain, then grouped addresses that were spent together. Grouping addresses spent in one payment as one owner is called clustering.
His conclusion contradicted the February 2014 filing. “Most or all of the missing bitcoins were stolen straight out of the MtGox hot wallet over time, beginning in late 2011,” Nilsson wrote3. A hot wallet is the online wallet an exchange uses to pay withdrawals. By the middle of 2013, he found, Mt. Gox had practically run out of spendable bitcoin.
He also found a pattern. Coins left Mt. Gox for new addresses, missing from its withdrawal logs, often a few hundred at a time3. He counted about 300,000 bitcoins taken that way between late 2011 and the end of 2012. Reuters carried the finding on April 20, 2015, citing the Financial Times. “This kind of activity would be hard to interpret as anything but intentional theft,” wrote Kim Nilsson, the report's author6. Reuters described WizSec as "an independent consulting firm" and Nilsson as its "chief engineer".
What the 2017 post added
The July 2017 post went further1. In September 2011, someone copied Mt. Gox's wallet file and with it the hot wallet's private keys. By mid-2013, the thief had taken about 630,000 bitcoins. A bookkeeping error, caused by reused addresses, put Mt. Gox's numbers out of balance by about 40,000 more.
Most of the stolen coins went first to wallets Nilsson tied to Vinnik, and then to BTC-e1. In total some 300,000 bitcoins ended up on BTC-e, an exchange based in Russia7. Coins sent back onto Mt. Gox let WizSec link two accounts to an online identity, "WME," and from there to Vinnik.
Nilsson drew a line around his own claim. “To be clear, this investigation turned up evidence to identify Vinnik not as a hacker/thief but as a money launderer; his arrest news also suggests this is what he is being suspected for,” he wrote1.
What the coverage missed
SiliconANGLE covered the post hours later, at 03:19 UTC on July 27, 20177. Its story called WizSec “a Japanese security company that has long been investigating the Mt. Gox case”. Duncan Riley, the reporter, quoted the post and left the investigator unnamed.
So who did the work, and on what budget? Nilsson answered both questions in 2015. “Also, I'm doing all of this for free, and going through and cleaning up big data for publication is not the best way to spend what little time I have,” he wrote3. The same post described the response from officials: "official interest has been pretty low," he wrote.
Where the customers went
Market data show Mt. Gox's trading shrinking in the same months. Bitcoinity counts the bitcoin traded against the dollar on each exchange, month by month14. Mt. Gox traded 4,725,034 bitcoin in April 2013. By January 2014 it traded 295,568, behind BTC-e at 398,565 and Bitstamp at 443,571.
Mt. Gox traded 295,568 bitcoin in January 2014, behind BTC-e and Bitstamp
Bitcoin traded against the US dollar each month on three exchanges, in bitcoin
- Mt. Gox
- BTC-e
- Bitstamp
- Height: Bitcoin traded
Source: Bitcoinity [14].
Read the chart as a table
| Item | Mt. Gox | BTC-e | Bitstamp |
|---|---|---|---|
| Jul 2012 | 1,902,113 BTC | 23,133 BTC | 50,704 BTC |
| Aug 2012 | 2,448,351 BTC | 33,057 BTC | 83,272 BTC |
| Sep 2012 | 959,781 BTC | 2,826 BTC | 55,624 BTC |
| Oct 2012 | 1,154,902 BTC | 15,100 BTC | 83,767 BTC |
| Nov 2012 | 804,192 BTC | 106,132 BTC | 88,482 BTC |
| Dec 2012 | 876,916 BTC | 73,776 BTC | 91,543 BTC |
| Jan 2013 | 1,455,183 BTC | 95,993 BTC | 124,203 BTC |
| Feb 2013 | 1,575,229 BTC | 78,049 BTC | 120,081 BTC |
| Mar 2013 | 2,058,511 BTC | 121,551 BTC | 177,214 BTC |
| Apr 2013 | 4,725,034 BTC | 599,590 BTC | 420,538 BTC |
| May 2013 | 2,069,391 BTC | 261,547 BTC | 297,242 BTC |
| Jun 2013 | 1,046,481 BTC | 139,287 BTC | 243,490 BTC |
| Jul 2013 | 1,124,882 BTC | 185,431 BTC | 416,703 BTC |
| Aug 2013 | 577,217 BTC | 98,033 BTC | 330,376 BTC |
| Sep 2013 | 421,361 BTC | 98,932 BTC | 303,949 BTC |
| Oct 2013 | 727,469 BTC | 283,286 BTC | 582,412 BTC |
| Nov 2013 | 1,083,534 BTC | 639,121 BTC | 964,613 BTC |
| Dec 2013 | 942,385 BTC | 783,237 BTC | 946,906 BTC |
| Jan 2014 | 295,568 BTC | 398,565 BTC | 443,571 BTC |
| Feb 2014 | 985,039 BTC | 503,845 BTC | 824,551 BTC |
Prices split as well. In November 2013, Mt. Gox's monthly average price was $561.57, against $527.61 on Bitstamp1516. December averaged $842.93 on Mt. Gox and $794.16 on Bitstamp. January 2014 ran $934.63 against $818.74. Then February flipped, to $528.22 on Mt. Gox and $663.80 on Bitstamp.
Each figure is Bitcoinity's average for a calendar month in UTC, read on October 13, 20261516. Mt. Gox closed its site at noon Japan time on February 25, 20144.
Bitcoin averaged $934.63 on Mt. Gox in January 2014 and $818.74 on Bitstamp
Average bitcoin price for each calendar month in UTC, on Mt. Gox and on Bitstamp, in US dollars
- Mt. Gox
- Bitstamp
Sources: Bitcoinity [15]; Bitcoinity [16].
Read the chart as a table
| Item | Mt. Gox | Bitstamp |
|---|---|---|
| Nov 2013 | $561.57 | $527.61 |
| Dec 2013 | $842.93 | $794.16 |
| Jan 2014 | $934.63 | $818.74 |
| Feb 2014 | $528.22 | $663.80 |
The charges that followed
FinCEN, the Treasury's anti-money-laundering bureau, acted on July 27, 20178. The bureau fined BTC-e $110,003,314 and Vinnik $12 million. "BTC-e processed over 300,000 bitcoin in transactions traceable to the theft," FinCEN said.
Six years later, on June 9, 2023, the Justice Department unsealed charges filed in 201911. The charges accuse Alexey Bilyuchenko and Aleksandr Verner of conspiring to launder bitcoin stolen from Mt. Gox. Prosecutors say the group took 647,000 bitcoins between September 2011 and May 2014. More than 300,000 of those coins were laundered on an exchange the group controlled, the charges allege.
Vinnik pleaded guilty in San Francisco on May 3, 2024, to conspiracy to commit money laundering12. BTC-e processed over $9 billion in transactions, and Vinnik enabled the laundering of at least $121 million, the release said. It credited former IRS special agent Tigran Gambaryan among those who supported the investigation. In February 2025, the United States traded Vinnik for Marc Fogel, an American teacher held in Russia13.
The case for the tracing
Jamal El-Hindi, then FinCEN's acting director, framed the 2017 penalty as a warning to every exchange. “This action should be a strong deterrent to anyone who thinks that they can facilitate ransomware, dark net drug sales, or conduct other illicit activity using encrypted virtual currency,” El-Hindi said8.
Nilsson's counts held up against the official ones. His 630,000 stolen coins by mid-2013 sit close to the 647,000 prosecutors alleged through May 2014111. WizSec's 300,000 on BTC-e matches FinCEN's "over 300,000"8. Nilsson's 2015 advice to exchanges was four words long: "Always. Monitor. Your. Bitcoins."3
The case against
Vinnik denied the charges for years before his 2024 plea. He spoke at an October 4, 2017, hearing in Thessaloniki. Vinnik told the judges he was a technician and BTC-e was one of his clients, AP reported9. In Paris in October 2020, his lawyer Zoé Konstantopoulou said the case began with an American claim. “There was no French investigation. The Americans said: it's Vinnik… and said: 'make sure he is being transferred to the U.S.,'” Konstantopoulou told the court10.
A Paris court convicted Vinnik of money laundering on December 7, 2020, and sentenced him to five years20. The same court acquitted him of extortion, his lawyers said. Nilsson's own post set a limit too: Vinnik "may have merely bought cheap coins from thieves," he wrote1. The 2023 theft charges remain allegations in every source opened for this piece11. Vinnik went to Russia in the 2025 swap, before a U.S. judge had sentenced him13.
What to watch
Mt. Gox's trustee, Nobuaki Kobayashi, moved the repayment deadline to October 31, 2026, Japan time18. He said many creditors still had to finish the steps to receive payment. Repayments in bitcoin and bitcoin cash began on July 5, 202417. The estate held 166,344 bitcoin on March 5, 2018, after selling 35,84119.
Creditors who have yet to complete those steps have until that deadline. Nilsson's 2017 post was titled part 1, and the WizSec archive, through its last post in March 2024, holds that part alone2.
Sources
- Kim Nilsson, "Breaking open the MtGox case, part 1," WizSec, July 27, 2017 (Japan time), https://blog.wizsec.jp/2017/07/breaking-open-mtgox-1.html
- WizSec, "WizSec blog post feed, with each post's publication time," read Oct. 13, 2026, https://blog.wizsec.jp/feeds/posts/default
- Kim Nilsson, "The missing MtGox bitcoins," WizSec, Apr. 19, 2015, https://blog.wizsec.jp/2015/04/the-missing-mtgox-bitcoins.html
- MtGox Co., Ltd., "Announcement Regarding An Application For Commencement Of A Procedure Of Civil Rehabilitation," Feb. 28, 2014, https://www.mtgox.com/img/pdf/20140228-announcement_eng.pdf
- MtGox Co., Ltd., "Announcement regarding the balance of Bitcoin held by the company" (in Japanese), Mar. 20, 2014, https://www.mtgox.com/img/pdf/20140320-btc-announce.pdf
- Reuters, "MtGox insolvent long before collapse - FT.com," Reuters (via Yahoo News), Apr. 20, 2015, https://au.news.yahoo.com/mtgox-insolvent-long-collapse-ft-001444519.html
- Duncan Riley, "Russian bitcoin exchange operator arrested, linked to collapse of Mt. Gox exchange," SiliconANGLE, July 27, 2017, https://siliconangle.com/?p=390999
- Financial Crimes Enforcement Network, "FinCEN Fines BTC-e Virtual Currency Exchange $110 Million for Facilitating Ransomware, Dark Net Drug Sales," FinCEN, July 27, 2017, https://www.fincen.gov/news/news-releases/fincen-fines-btc-e-virtual-currency-exchange-110-million-facilitating-ransomware
- Costas Kantouris, "Greece backs extradition of Russian to US over bitcoin fraud," Associated Press (via Fox Business), Oct. 4, 2017, https://foxbusiness.com/markets/greece-backs-extradition-of-russian-to-us-over-bitcoin-fraud
- Nicolas Vaux-Montagny, "Trial of Russian in alleged bitcoin fraud to wrap in Paris," Associated Press (via CFJC Today), Oct. 23, 2020, https://cfjctoday.com/?p=851179
- Jonathan Greig, "Russian nationals accused of Mt. Gox bitcoin heist, shifting stolen funds to BTC-e," The Record, June 9, 2023, https://therecord.media/mt-gox-stolen-bitcoin-indictment-russian-nationals
- U.S. Department of Justice, "BTC-e operator pleads guilty to money laundering conspiracy," IRS Criminal Investigation, May 3, 2024, https://www.irs.gov/compliance/criminal-investigation/btc-e-operator-pleads-guilty-to-money-laundering-conspiracy
- Catherine McGrath, "Who is Alexander Vinnik, the Bitcoin criminal Trump freed in a prisoner exchange with Russia?," Fortune, Feb. 13, 2025, https://fortune.com/crypto/2025/02/13/who-is-alexander-vinnik-bitcoin-criminal-trump-freed-exchange-russia/
- Bitcoinity, "Bitcoin trading volume, USD markets, monthly by exchange (CSV export)," read Oct. 13, 2026, https://data.bitcoinity.org/export_data.csv?currency=USD&data_type=volume&exchange=&r=month&t=b×pan=all
- Bitcoinity, "Bitcoin price, USD, monthly, Mt. Gox (CSV export)," read Oct. 13, 2026, https://data.bitcoinity.org/export_data.csv?currency=USD&data_type=price&exchange=mtgox&r=month&t=l×pan=all
- Bitcoinity, "Bitcoin price, USD, monthly, Bitstamp (CSV export)," read Oct. 13, 2026, https://data.bitcoinity.org/export_data.csv?currency=USD&data_type=price&exchange=bitstamp&r=month&t=l×pan=all
- Nobuaki Kobayashi, "Notice regarding Repayment in Bitcoin and Bitcoin Cash," MtGox Rehabilitation Trustee, July 5, 2024, https://www.mtgox.com/img/pdf/20240705_01_announcement_en.pdf
- Nobuaki Kobayashi, "Notice Concerning Change of Repayments Deadline," MtGox Rehabilitation Trustee, Oct. 27, 2025, https://www.mtgox.com/img/pdf/20251027_1cc36334-e8b2-4fe4-8135-97d9a149e4f7_announcement_en.pdf
- Nobuaki Kobayashi, "Report of the bankruptcy trustee to the creditors' meeting, March 2018," MtGox Rehabilitation Trustee, Mar. 7, 2018, https://www.mtgox.com/img/pdf/20180307_report.pdf
- Associated Press, "Russian sentenced to French prison for bitcoin laundering," Associated Press (via Click2Houston), Dec. 7, 2020, https://www.click2houston.com/business/2020/12/07/russian-sentenced-to-french-prison-for-bitcoin-laundering/