First, Tux (the owner of MtGox) has been participating in the Github discussion about getting a "normalized txid" implemented ASAP to address the malleability issue.
Here's the github discussion: https://github.com/bitcoin/bitcoin/pull/3656
Here's the latest comment from Tux (8 hours ago):
"Just to update this thread, it seems that this discussion is mostly stale now. We (at MtGox) will implement this new hash index in our transactions database and start working with it (we will announce a maintenance as we will have to stop bitcoin deposits too during the database schema update) and will start providing this new hash when customers are withdrawing bitcoins, litecoins, or any other coin based on Bitcoin we may support in the future.
We will also provide an API that will allow our customers to use this hash to retrieve the transaction hash as seen in the blockchain once the transaction is confirmed, and will hope others (blockchain.info?) will index this value one day.
We also invite other exchanges and businesses which may need to keep track of bitcoins they send to use this same method, since dealing with multiple variations of the same thing wouldn't be very productive."
As of an hour ago, blockchain.info has implemented the proposal. Here's an example of a "normalized txid": https://blockchain.info/ntxid/3c0b247b0f9107309c603441f0411b...
Why is ntxid important? Because for most practical purposes, ntxid cannot mutate. The recent attack was possible because people were able to mutate txids by changing the signature. So, "txid" includes the signature, but "ntxid" doesn't. Therefore ntxid is immune to the previous malleability attack vectors.
So what else boosts my confidence? Well, another aspect is that Gox support personnel have been in #mtgox almost 24/7 answering questions. They often don't have answers that people are seeking, but they have been professional and helpful to the best of their ability given the current situation.
A third thing that boosts my confidence is that Gox has, conservatively, made at least 120k bitcoin in profit from trade fees. It's more likely in the range of 440k. So even if they lost an ungodly amount of bitcoin, such as 70k, they will still have more than enough to cover the losses.
To expand on this third point, people have expressed at least two concerns about whether Gox has enough coins. The first concern is whether Gox has enough coins to cover the losses they suffered. For example, perhaps they've been paying themselves a massive salary, and perhaps they lost more than the amount of profit they had remaining. People feel that the press release was designed to drive down the price of bitcoin, perhaps to sell high and buy low in order to grow their bitcoins by enough to cover the losses. But this doesn't make sense, because bitcoin's price rapidly recovered on all the other exchanges. This method wouldn't have been able to net them more than a few thousand btc. Plus, their own buy order would influence the price itself. The logic of "Gox issued an accusatory press release to drive down the price" doesn't seem to hold up.
The second concern is that people believe Tux will use this as a way to get out of bitcoin entirely and retire. I don't know Japan's law, but people seem to believe Gox is the equivalent of a limited liability corp, which is of course designed to limit personal liability in the event of a massive screwup such as the one Gox has suffered. People say that since there was no malicious intent by Gox, then Gox may simply be closed down without much penalty to Tux.
But if that were the case, then Tux's behavior would become very different very quickly. It seems pretty likely that Gox has, by now, calculated how many coins they've lost. Tux knows whether they're solvent. If they aren't able to cover losses, why would he be participating in Github? Why is he seemingly working so hard to resolve the issue? In that situation, "keeping appearances" isn't valuable. His time would be better spent speaking with lawyers and crafting his legal defense. This doesn't seem to be happening.
So at this point we know the malleability exploit was real and that Gox really was bitten by it. We know they responded to the exploit in the only way that they were able: by suspending withdraws before further coins were siphoned out of Gox's systems. We know that Gox aren't making any exceptions to this withdraw suspension, not even for customers with large bitcoin holdings. (To me, this seems quite fair.) We know that Tux has been personally working with the bitcoin devs to push through a proposed fix to the protocol, and we know that the proposal has already been implemented in blockchain.info's website.
Lastly, and most persuasively, we know that the expected value for Tux to reopen Gox is the massive amount of trade fees he stands to earn in the future. This incident will shake people's faith in Gox, but people are fickle, and if just 30% of their user base sticks with Gox then that means in another few years Gox will have earned 30% of "a massive amount of profit from the trade fees." That's still quite a bit of profit, and profit is better than no profit. Since Gox stands to earn at least another $million USD in trade fees over the next few years, then that's a million reasons for him to continue operating the exchange.
Tux's behavior is roughly the opposite of what you'd expect from someone who was about to shut down their business.
I had the option to sell my bitcoins in my MtGox wallet for 80% of their value. For example, if I transfer 1 bitcoin from my Gox wallet to their Gox wallet, then they would send me 0.8 btc to my external wallet address in return. But I chose not to sell off my Gox bitcoin, because the probability of Gox closing seems much less than 20% due to all of the above reasons. I'm going to wait it out.