I was watching my account until after this happened and nothing was missing, what you saw is every buy order being executed as a large sell order was filled.

and you can't have script selling many small amounts only from 1 account?

You are talking BS, because I was there when it happened, logged on mtgox, and when it was over, my account was untouched.

What you see on that list, is individual bids being supplied by a single sell order.

Not every account would be compromised. Some accounts have stronger passwords and have a salt, making them harder to brute force. But the majority does not.

if someone put in a single order to sell 50,000 BTC at $.01 then however many small buy orders were out there would have all been executed as different transactions, and there would now be thousands of people that bought BTC at prices all the way down to $.01. It is more likely that a single large account created those transactions rather than a lot of individuals accounts.

All leaked passwords are either MD5 hashes or FreeBSD MD5 crypt() hashes. The attacked must have changed all hashes to a known one in order to be able to log into each other users' account. It's not impossible to execute a simple UPDATE query given the fact that the entire passwords database was dumped. Then it would be impossible for you to log into your MtGox account unless the hacker has restored the original hashes.

Most people have never tried to code a big exchange market, so they have no idea how they work, or what they look like in action.  Those of us who have aren't fooled.

The exchange has two lists, one for buy orders, one for sell orders.  The order matcher finds the buy order with the highest amount, and the sell order with the lowest amount.  If there is a tie in either of these, it will go to the oldest one.  If there is an overlap, a sale is recorded, balances are updated, the smaller order is closed, the larger order is decremented by the size of the smaller order (or if they were the exact same size, they both close).  Rinse, repeat.

A large order, like selling 500,000 coins for not less than 0.01 $ each, will hit thousands of buy orders, one by one as it chews through the order book.

... I'm a little bit confused. It is obvious that the stolen database wasn't used to mass sell on every account. Does that mean that the 400k btc withdraw was unrelated? Or it was related in that the owner of that wallet had his password stolen from the mtgox database?

Who made the database public to begin with?

Things are getting clearer.

The hacker has access to many accounts with high BTC. He cannot withdraw because of the limit of 1000$ equivalent BTC. What does he do? He sells offs tons of BTC to drive the price down to almost nothing. Then he empties any number of BTC he wishes. The coins are depleted, many people lost a fortune.

It was a 500K movement, maybe the attacker merging the coins to his main wallet. Even @0.01 he couldn't withdraw that many.