MtGox Civil Rehabilitation Claims Process: Password Reset Barrier
ConstrainedCustodial platform became inaccessible — recovery ran through a lengthy institutional process.
Following the MtGox collapse, Japan's civil rehabilitation framework opened a formal claims process to distribute recovered assets to affected users. However, a structural custody failure emerged: users who had forgotten their MtGox account passwords could not access the platform's password reset functionality to reestablish access, as the infrastructure supporting account recovery remained offline post-collapse.
This created a paradoxical barrier. The rehabilitation process required users to file claims, but many could only prove asset ownership through account access—access that the password reset mechanism was meant to facilitate. Users without recorded passwords or alternative proof of account ownership faced additional friction in the claims pipeline.
The incident reflects a core custody risk of centralized exchange platforms: password resets and account recovery depend entirely on the platform's operational infrastructure. When an exchange collapses or enters receivership, users lose not only asset access but also the procedural tools needed to prove historical ownership. Unlike self-custody scenarios where loss of passphrase is permanent at point of loss, exchange custody created a secondary failure mode: the infrastructure for password recovery itself became inaccessible.
The MtGox civil rehabilitation ultimately recovered significant assets for creditors, but the claims process itself was delayed and complicated by documentation barriers that might have been avoidable under different custody arrangements. Users without external records of account details or alternative verification methods faced extended delays.
| Stress condition | Vendor lockout |
| Custody system | Exchange custody |
| Outcome | Constrained |
| Documentation | Partial |
| Year observed | 2014 |
| Country | Japan |
Why custodial Bitcoin fails differently than self-custody
Exchange custody transfers the custody problem from the holder to the institution. The holder no longer needs to manage seed phrases, maintain hardware, or understand cryptographic concepts. They need only to maintain their account. This simplicity has a cost: the holder no longer controls the private keys. Access depends entirely on the continued operational, financial, and regulatory health of the exchange.
Cases in this archive show that exchange failures cluster around specific event types: bankruptcy and insolvency, regulatory seizure, geographic sanctions, and account-level access failures (lost 2FA, forgotten email credentials). Each event type has a different recovery path and a different timeline. Bankruptcy proceedings typically take 6-24 months and produce partial recovery. Regulatory seizure timelines depend on legal process. Account access failures may be resolvable through platform support or may not.
The distinguishing feature of vendor lockout cases is that recovery — when it occurs — happens through processes the holder did not design and cannot control. They become claimants in a process rather than holders of an asset.
The primary protection against vendor lockout is not using a vendor for custody beyond what is needed operationally. Holdings intended to be stored long-term are most exposed to institutional risk. Exchange custody is well-suited for active trading and conversion; it is poorly suited for long-term storage of significant value. Moving Bitcoin off exchange into self-custody eliminates platform dependency at the cost of taking on personal custody responsibility.