QuadrigaCX was Canada’s largest cryptocurrency exchange by volume until their website suddenly went offline on January 28, 2019. The exchange reportedly held about CAD $250 million in customer cryptocurrency and fiat. Leading up to the cessation of operations, customers had been reporting on social media that they were experiencing delays with fulfilling withdrawal requests. However, things seriously began to unravel on January 31, 2019 when the message at quadrigacx.com citing maintenance as the reason for being offline – was replaced with a notice that the company had filed with the Nova Scotia Supreme Court for creditor protection. It will likely be some time before investors get a sense of what this all means, but what has been revealed to date paints a portrait of utter dismay.
According to a filing with the Ontario Supreme Court of Justice released – November 9, 2019 – Canadian Imperial Bank of Commerce (CIBC) had frozen about CAD $25.7 million linked to QuadrigaCX’s cryptocurrency exchange operations, and which the bank had considered to be disputed funds. The filing suggested that the frozen funds represented money transferred to Custodian Inc. – a processor for QuadrigaCX. Custodian Inc. was reportedly established for the sole purpose of receiving and holding deposits for individuals transacting on the QuadrigaCX platform, however, CIBC observed that the sole officer and director of Custodian Inc. transferred a portion of deposited funds to his personal account with CIBC. QuadrigaCX attributed delays in customer withdrawals to the freezing of funds by the bank according to media reports. Customers took to social media to complain about issues concerning withdrawal requests.
On January 14, 2019, a Tweet from the QuadrigaCX account announced that Gerald (Gerry) Cotten – the company founder and CEO – had passed. The affidavit filed in the Supreme Court of Nova Scotia by his widow Jennifer Robertson is a chilling account of how Mr. Cotten managed hundreds of millions in investor funds. Investors and regulators should take careful note.
According to the court filing published on scribd.com:
- Gerry was the sole officer and director of QuadrigaCX
- QuadrigaCX had no physical location
- QuadrigaCX was operated from any place where Gerry and his laptop were located
- The majority of cryptocurrency on deposit was stored in offline cold storage
- The physical location of QuadrigaCX’s cold storage wallet was only known to Gerry
- Gerry – and only Gerry – manually controlled transfers of cryptocurrency between hot and cold storage wallets
- QuadrigaCX had $180 million worth of customer cryptocurrency and $70 million more in cash owing to its customers
- QuadrigaCX was unable to obtain a bank account, because the company dealt with cryptocurrency
- QuadrigaCX employed the services of payment processors to facilitate the receipt of user funds and payouts
- Custodian Inc. (a QuadrigaCX payment processor) was engaged to receive deposits from QuadrigaCX users and make payments
- On January 8, 2018 CIBC froze the Custodian Inc. account after it went into overdraft
- An error was rectified, and deposits to the account continued to be received
- CIBC paid the balance of about $25.7 million into the court and closed the bank accounts for Custodian Inc. and its director
- Upon resolution of the litigation, the court issued payment to Custodian Inc.
- Neither Custodian Inc. nor QuadrigaCX had been able to find a bank to negotiate the draft or open an account
- Gerry died in India unexpectedly on December 9, 2018 – at the age of 30, due to complications related to Crohn’s disease
- No business documents or records for QuadrigaCX could be found after the founder’s death
- Gerry operated QuadrigaCX from an encrypted laptop to which credentials are unknown
- Gerry had sole responsibility for managing cryptocurrency in cold storage
- QuadrigaCX cannot access its inventory of cryptocurrency
I suspect that this is not the business model that users of the platform envision when they think of the country’s largest cryptocurrency exchange. In the coming days, weeks, and months we can expect to see analysis of blockchains in attempts to first identify the affected addresses, and secondly to monitor them for any movement of funds following Gerald’s death. The search for the cold storage wallet will no doubt continue. Best practices will be revisited. For example, why were multi-signature wallets not employed. The regulatory climate will be assessed from a consumer protection perspective. In Canada, cryptocurrency regulations impose tax obligations on consumers. As a commodity, cryptocurrency is subject to tax on gains. Regulations also provide provisions for anti-money laundering and anti-terrorist financing (AML/ATF) – which impose obligations on money services businesses (MSB). However there does not appear to be any provision to prevent what is essentially a banker in the crypto world from being the sole custodian of keys to a virtual vault that stores millions of dollars in consumer deposits.
What crypto investors should be asking themselves right now
- How do I validate claims by my service provider that my cryptocurrency is in cold storage?
- Where is the physical location of my service provider’s cold storage crypto wallets?
- Am I satisfied with the physical security around the cold storage devices?
- Are my funds insured?
- Are crypto and cash deposits held by the service provider audited regularly?
- Are audit results made available to users?
- What protocols are in place to prevent a single actor from compromising the provider’s cold wallet?
- What protocols are in place to ensure continuity when a person with credentials to a cold storage wallet is indisposed?
QuadrigaCX has reportedly retained the services of an expert to hack into the encrypted laptop and an encrypted USB device for answers that may lead them to the funds. They are also reportedly pursuing recovery of funds held by a number of processors on behalf of the company. This will likely drag on for years. For the sake of all affected users of the QuadrigaCX platform, I hope that access to the private keys was not extinguished with the life of the company’s founder.