Is that how this happened?
Given that bitcoins are supposed to be owned by addresses that are protected by private key, I wondered why people couldn't "withdrawal" their bitcoins. If Mt. Gox was controlling the private keys (as a hosted wallet service) that makes more sense.
In the future there will potentially be decentralized exchanges where a Bitcoin transaction can be a component of an exchange transaction and there is no third-party involved. But not today.
In a proper BTC exchange, most of the Bitcoin are in cold storage, which means they can't be stolen even if the exchange was hacked. The hot wallet would represent the variability in the exchanges BTC holdings and would be very small, so that in case of theft it could be either insured or covered.
That to me sounds like it's safer than any scheme I can come up with, without losing the mobility of the BTC.
Of course, if this document is true, it means MtGox did absolutely no accountancy on their cold wallets for the past 3 years.. that's just plain crazy :(
* Make a physical deposit against an account number we give you at a bank branch
* Buy Linden Dollars, swap them for Bitcoin, swap them for Dogecoin
* Give people gift card codes
* Pay random people via PayPal or Google Wallet
The last of those was the least sketchy looking but by and large it creeped me the hell out. The options looked like 50% scamming and 50% money laundering.
And a lot of the intermediary payment services like Dwolla stopped working with btc. So if you want doge, either mine it, get sent it from random strangers, or trade it for btc (which is more readily available through services like coinbase).
And before you say "more regulation" - Paypal is not a bank and operates as a money transfer service. They can and have frozen people's accounts out before.
The reason the methods are so strange is that most other method allow the buyer to do a chargeback and scam the seller.
Similarly, if you deposit $100 USD(5 physical 20 dollar bills) in a bank those physical bills don't just sit there waiting for you. They can be given to anyone during the course of the business. You just get "100" added to some database row somewhere. When you want that $100 back, the Bank has to reach into its funds and pay you.