So Mt. Gox is dead. Filed for bankruptcy protection in Tokyo on Friday, and the number everyone's repeating is 850,000 bitcoins gone, missing, vanished into whatever void these things vanish into. At Friday's prices that's something like $450 million, though good luck getting two people to agree on an exact figure because the price has been all over the place since the news broke. It was trading north of $1200 back in November. Now it's sitting closer to $550, and I wouldn't be shocked if it's lower by the time I hit publish on this.
I want to be clear, I never had money on Mt. Gox. Never had a Mt. Gox account at all, actually. But I've got a friend, I'll just call him Dave because that's not his name and he'd kill me, who mined a chunk of bitcoin back in 2011 on a couple of old GPUs in his apartment closet, sold most of it off ages ago for beer money, and left maybe two or three coins sitting on the exchange because he figured he'd cash them out eventually. Hasn't talked to me about it since Thursday. I don't blame him.
Here's the thing that gets me. This wasn't some sudden thing that happened overnight. Mt. Gox had been acting weird for weeks. They paused withdrawals back in early February, blamed a "transaction malleability" bug (which, fine, is a real thing, but come on), and then the site just went dark a few days ago with nothing on it but a blank page. Anyone paying attention could see something was badly wrong. And yet people kept trading on there right up until it vanished, because the alternative was admitting they might lose everything, and nobody wants to be the guy who panicked for nothing.
I don't think bitcoin itself is dead, if that's what you're wondering, and I'm not writing this to gloat about being a skeptic (okay, maybe a little). What actually bugs me is how many people conflated "the exchange" with "the currency." Mt. Gox wasn't bitcoin, it was a company, one that started out trading Magic: The Gathering cards online, which is such a perfect ridiculous detail I almost don't believe it myself even though it's true. A company with apparently no real security auditing, no cold storage discipline worth mentioning, and by most accounts a CEO who was, charitably, in over his head. You handed that company your money and trusted it the same way you'd trust a bank, except it wasn't a bank, it had none of the protections a bank has, and it turns out that mattered a whole lot.
I've spent enough years watching startups handle other people's data and money badly that none of this should surprise me anymore, and yet it still does, every single time. We had the Adobe breach back in October, something like 150 million accounts, and before that Target over the holidays with roughly 40 million card numbers walking out the door. Different flavor of disaster, same root cause really: we keep handing sensitive stuff to companies that aren't equipped to protect it, because the alternative (doing it yourself) is annoying and slow and we're all lazy, myself very much included.
What I'd actually do differently
If you've got money sitting in any exchange right now, go double check it's actually there. That's not paranoia, that's just Tuesday in 2014 apparently. Print out your balances if you have to. Move anything you care about to a wallet you actually control, on a drive that isn't plugged into the internet 24/7. It sounds excessive until it's the thing that saves you.
And can we please stop treating "the site has a nice logo and a professional-looking dashboard" as a security credential? That's basically all Gox had going for it toward the end. A clean UI sitting on top of what sounds like a total mess behind the scenes.
One last thing, completely unrelated: I finally caved and bought a real burr coffee grinder instead of the blade one that's been living on my counter since college, and it's honestly changed my mornings more than any piece of software has in the last year. Forty bucks and I'm annoyed I waited this long. Make of that what you will.