Breaking open the Mt. Gox case, part 1
This would have all been avoided if MtGox had transferred its coins to a new wallet after the 2011 breach. I guess they assumed that any attacker that got access to the private keys would have immediately emptied the wallet, and the fact that this hadn't happened proved that the private keys hadn't been compromised by the breach.I have to admit, that is a reasonable assumption. This may show the limits of the usefulness of heuristics, and the importance of organizations like exchanges, that have very significant fiduciary duties, to undertake a systematic process after a security breach to eliminate all possible remaining vulnerabilities, no matter how unlikely and counterintuitive.