Incidents & Turning Points

Silk Road was an anonymous dark web marketplace founded in 2011 by "Dread Pirate Roberts" (Ross Ulbricht). Bitcoin was its only payment method.

In October 2013 the FBI shut down the site and arrested Ulbricht. About 144,000 BTC, worth $28.5 million at the time, were seized.

Ulbricht was convicted in 2015 on counts including narcotics distribution conspiracy and money laundering conspiracy, and sentenced to life in prison without the possibility of parole. On January 21, 2025 President Trump granted him a full and unconditional pardon, and he was released after roughly eleven years. Views on the pardon diverge sharply: supporters say the sentence was disproportionate for nonviolent offenses, while critics say the clemency discounts the harm done by the drugs sold through the site.

Silk Road cemented Bitcoin's image as "criminal money," but it also proved that Bitcoin works as a censorship-resistant way to move value.

The U.S. Marshals Service later auctioned the seized bitcoins, and venture capitalist Tim Draper bought them in bulk.

The case also changed how people thought about Bitcoin privacy: it showed that blockchain analysis can trace Bitcoin transactions, a point that became widely understood through this investigation.

Mt.Gox was founded in 2010 and at its peak handled roughly 70% of all Bitcoin transactions worldwide. It started life as a Magic: The Gathering Online Exchange, which is where the name comes from.

In February 2014 it announced the loss of about 850,000 BTC, worth $450 million at the time and tens of billions at current prices. Internal mismanagement and hacking were both blamed. What it filed with the Tokyo District Court on February 28 was not bankruptcy but civil rehabilitation; the case converted to bankruptcy proceedings that April and was moved back into civil rehabilitation in November 2017. Creditor repayments today run under that civil rehabilitation framework.

The gap between the 850,000 BTC reported lost and the roughly 140,000 BTC later covered by repayments is explained by the discovery of about 200,000 BTC in an old-format wallet in March 2014. The effective loss was on the order of 650,000 BTC, and the recovered coins passed into the trustee's custody, becoming the source of the repayments a decade later.

The lesson that outlived the exchange: "Not your keys, not your coins" — if you do not control the private keys, you do not really own the coins. The phrase has been repeated ever since.

Former CEO Mark Karpelès stood trial in Japan and was found not guilty of embezzlement but guilty of data manipulation (unauthorized creation and use of electromagnetic records). On March 15, 2019 the Tokyo District Court sentenced him to two years and six months in prison, suspended for four years, far short of the ten years prosecutors had sought.

Creditor repayments began in 2024, nearly a decade later. They cover roughly 140,000 BTC and are proceeding in stages, including returns in kind; the repayment deadline has been extended several times and distributions are ongoing. The collapse became a turning point that fundamentally changed security standards across the entire crypto industry.

The DAO was a decentralized investment fund on Ethereum. In May 2016 it raised about $150 million, roughly 14% of all the ETH in existence at the time.

In June 2016 an attacker exploited a flaw in its smart contract and drained about 3.6 million ETH, worth roughly $50 million.

What makes this relevant to Bitcoin is the philosophical argument it started over "immutability." Ethereum hard-forked the following month, in July 2016, to reverse the attack, splitting into Ethereum (reversed) and Ethereum Classic (unchanged); the hack and the split did not happen in the same month.

The Bitcoin community read the episode as a lesson in why immutability matters. The shared understanding that a comparable rollback is unthinkable on Bitcoin is part of what the network is valued for.

The most intense internal dispute in Bitcoin's history split the community over how to grow past the 1MB block size limit.

"Big blockers" (Roger Ver, Jihan Wu, and others) wanted to raise the block size directly through a hard fork and scale on-chain.

"Small blockers" (Gregory Maxwell, Pieter Wuille, and others) wanted SegWit, a soft fork, plus Layer 2 systems such as the Lightning Network.

On August 1, 2017 Bitcoin Cash (BCH) split off in a hard fork. SegWit activated on Bitcoin itself later that month, at block 481,824 on 24 August; the fork and the activation were not the same day.

The dispute forced the question of "who governs Bitcoin?" into the open. The outcome showed that node operators, meaning users, hold the final say (UASF: User Activated Soft Fork).

Bitfinex (2016): about 120,000 BTC, worth roughly $72 million, was stolen. In 2022 the U.S. DOJ recovered $3.6 billion, at the time the largest crypto-related seizure on record.

Coincheck (2018): about $530 million worth of NEM (XEM) was drained from this Japanese exchange. Weak hot wallet management was the cause, and the theft brought stricter FSA rules. In March 2018 the company compensated roughly 260,000 affected users out of its own funds at ¥88.549 per XEM, about ¥46.3 billion in total. It received two business improvement orders from the FSA and became a wholly owned subsidiary of Monex Group that April.

Binance (2019): about 7,000 BTC, worth roughly $40 million, was stolen through phishing and malware. The SAFU fund covered the user losses.

DMM Bitcoin (31 May 2024): 4,502.9 BTC, about ¥48.2 billion at the time, was drained from a wallet managed by this Japanese exchange. U.S. authorities attributed the intrusion to the North Korea-linked TraderTraitor group. The company compensated customers in full but gave up on continuing the business, transferring accounts and custodied assets to SBI VC Trade and shutting down its services in March 2025. It is the first case in Japan of an exchange being wound up as a direct consequence of a theft.

Bybit (21 February 2025): 401,347 ETH, roughly $1.4–1.5 billion at the time, was drained from an Ethereum cold wallet. It is the largest crypto theft on record, more than three times the ~$450 million lost at Mt.Gox. The attackers compromised the development environment of the Safe{Wallet} multisig tooling and altered what the signers saw on their approval screens, so that they authorized a fraudulent transfer out of cold storage. The target was not the keys themselves but the screen the people approving the transaction were looking at. The FBI attributed the theft to the North Korea-linked Lazarus (TraderTraitor) group. Bybit closed the resulting gap in customer assets within about 72 hours by raising funds externally.

Every one of these incidents was a failure of exchange security or of the tools around it. The Bitcoin protocol itself has never been hacked.

The lesson: do not keep large amounts of bitcoin on an exchange. Hold your own keys, with a hardware wallet or multisig.

In November 2022 FTX, the world's second-largest crypto exchange, collapsed. CEO Sam Bankman-Fried was arrested for misappropriating customer funds.

About $8 billion in customer funds disappeared through opaque flows of money between FTX and its sister company, Alameda Research.

The whole crypto market crashed, with Bitcoin falling to around $16,000, and the "crypto winter" deepened.

FTX proved the point of "Not your keys, not your coins" all over again, and it pushed forward the debate about Proof of Reserves and custody rules.

Bankman-Fried was sentenced to 25 years in prison in 2024. On 12 June 2026 the U.S. Court of Appeals for the Second Circuit rejected his appeal outright, and the mandate issued on 4 August 2026 made the conviction and sentence final. He has filed a pardon application, still pending as of August 2026, though the U.S. Senate passed a resolution opposing any pardon or commutation by a vote of 100 to 0.

The bankruptcy estate, by contrast, has recovered far more than anyone expected at the outset. The reorganization plan was confirmed in October 2024, and through the fifth distribution on 31 July 2026 general unsecured claims (Classes 6A and 6B) reached a cumulative 103% and convenience claims (Class 7) a cumulative 120%. Those percentages, however, are measured against dollar valuations as of the November 2022 petition date. Because the BTC price rose sharply between then and 2026, creditors who had deposited crypto are substantially worse off than if their assets had been returned in kind. That is a persistent criticism, and the reason a nominal figure above 100% cannot be read as "the losses have been made whole."

Nearly a decade after the 2014 collapse, the Japanese civil rehabilitation proceedings reached the point of paying creditors, starting in July 2024.

The total came to about 142,000 BTC and 143,000 BCH (Bitcoin Cash, which came out of the 2017 hard fork).

Creditors could choose between cash and repayment in kind, in actual BTC and BCH. Most chose in kind.

At the time of the collapse bitcoin traded around $450, a small fraction of its 2024 value, so many creditors became accidental long-term holders sitting on returns of more than 100x.

The market feared that returning so many coins at once would create selling pressure, but most of them were held and the impact was muted.

The process is still not finished as of August 2026. The repayment deadline has been extended three times and now stands at 31 October 2026; the trustee reports that roughly 19,500 creditors have been paid, while about 34,689 BTC remain in the trustee's custody, held up mainly by incomplete paperwork and unresolved verification issues.

Trustee Nobuaki Kobayashi ran the decade of international legal and technical work, and the case became a landmark for crypto asset bankruptcy proceedings.

On April 24, 2024 the U.S. DOJ arrested two operators of Samourai Wallet on charges of "unlicensed money transmission" and "money laundering conspiracy." Their CoinJoin service "Whirlpool" was at the center of the case.

The service never held user keys, and its operators argued that they never held customer funds, but prosecutors treated the overall flow of the service as money transmission.

That same year Wasabi Wallet, run by zkSNACKs, withdrew from the U.S. market, and Trezor turned off its CoinJoin feature for U.S. users.

In August 2023 Roman Storm, a developer of the Ethereum privacy mixer Tornado Cash, was indicted and arrested on similar grounds, setting the precedent that "writing privacy-protecting code" may itself be illegal. A 2025 jury convicted him on the unlicensed-money-transmitting conspiracy count and deadlocked on the rest. Prosecutors have sought a retrial on the deadlocked money-laundering and sanctions conspiracy counts, asking the court in March 2026 for an October 2026 start. Sentencing on the single count of conviction had also not been handed down as of August 2026, so the case remains unresolved.

Inside the Bitcoin community, the clash between "privacy is not a crime" and the regulators' view of "privacy tools = money-laundering facilitation" has grown sharp. The two Samourai operators pleaded guilty in July 2025, with the money-laundering conspiracy charge dropped and the unlicensed money-transmitting charge left standing, and in November 2025 they were sentenced to five and four years in prison respectively. More cases of this kind are likely.

2013: FinCEN, part of the U.S. Treasury, issued guidance for Bitcoin businesses, one of the first major government moves to recognize Bitcoin inside a regulatory framework.

2017: Japan amended its Payment Services Act to define crypto assets in law (then called "virtual currencies") and placed exchanges under a registration regime. It was the first national registration system among major economies, though not the world's first licensing scheme: New York State's BitLicense came earlier, in June 2015.

2021: El Salvador adopted Bitcoin as legal tender, the first country to do so. In January 2025, against the background of a financing agreement with the IMF, that legal-tender status was repealed and acceptance went back to being voluntary for businesses.

2023: The EU adopted MiCA (Markets in Crypto-Assets), a comprehensive regulatory framework for crypto assets.

2024: The U.S. SEC approved spot Bitcoin ETFs. BlackRock, Fidelity, and other large managers entered, bringing tens of billions of dollars in inflows.

2025: The United States established the Strategic Bitcoin Reserve, and the GENIUS Act, covering stablecoin regulation, was signed into law, moving broader crypto regulation forward.

Around the world, Bitcoin regulation is shifting from "ban" to "coexistence through regulation."