The basic issue was that there are parts of the bitcoin that are "secure" and can't be changed. And parts that aren't. The problem was that Mt. Gox was using the insecure parts to keep track of who had cashed out a bitcoin. This meant that someone would get a bitcoin from Mt.