Mt. Gox Private Keys Stolen
Hackers steal the unencrypted Mt. Gox wallet file, beginning the silent theft of 650,000 BTC that would cause the 2014 collapse.
In September 2011 (specifically identified around mid-September), a catastrophic security breach occurred at Mt. Gox that would remain undetected for nearly three years. Hackers gained access to Mt. Gox's servers and copied the unencrypted `wallet.dat` file containing the exchange's private keys. Unlike the visible 'Flash Crash' in June, this theft was silent. The attackers did not empty the wallet immediately. Instead, they used the stolen keys to periodically drain funds from Mt. Gox's cold storage addresses as new deposits arrived.
This event is the 'Patient Zero' of the Mt. Gox insolvency. The theft was made possible because the standard Bitcoin client at the time (pre-version 0.4.0) did not encrypt wallet files by default. The encryption feature would not be released until September 23, just weeks after the breach. For the next two years, Mark Karpelès operated the exchange assuming these cold storage funds existed, when in reality, they were being systematically siphoned off to the BTC-e exchange. By the time the theft was discovered in 2014, approximately 650,000 BTC had been stolen.
The September 2011 key theft is the single most damaging event in Bitcoin's corporate history. It turned the world's largest exchange into a fractional reserve Ponzi scheme (unintentionally or otherwise) and sowed the seeds for the 'Gox Winter' of 2014-2015. It brutally illustrated the necessity of multi-signature security and Proof of Reserves, concepts that were developed directly in response to this failure.
Key Sources: Medium (Jimmy Song): Mt. Gox Hack Explanation | WizSec: The Missing MtGox Bitcoins