QuadrigaCX (2019): The Missing Keys and What Investigators Found
QuadrigaCX said its founder died holding the only keys to customer funds. Investigators later found a very different story. A factual account of the 2019 case.
In January 2019, QuadrigaCX, then Canada's largest cryptocurrency exchange, announced that its founder had died unexpectedly and that nobody else could access the funds held in offline storage. Customers were owed tens of millions of dollars. Subsequent investigations found that much of the money was not there at all.
The company
QuadrigaCX was founded in Vancouver in 2013; by the time of its collapse its founder lived in Nova Scotia, where the court proceedings took place. It was run by Gerald Cotten, who was its chief executive, and Michael Patryn as co-founder. The exchange allowed customers to buy and sell bitcoin and other coins using Canadian dollars. As a private company, it had little public oversight.
The announcement
On 14 January 2019, the company announced that Cotten had died on 9 December 2018 in India, from complications of Crohn's disease. His widow, Jennifer Robertson, said in a legal affidavit that he alone controlled the encrypted laptop and passwords for the cold wallets, and that the company could not find them. The exchange had stopped withdrawals, and customers who had waited weeks for transfers now heard that their funds were inaccessible.
The company applied for creditor protection in the Nova Scotia Supreme Court at the end of January 2019. Early filings referred to about 115,000 affected users; the claims process later counted about 76,000 creditors owed roughly 215 million Canadian dollars in cash and crypto.
What the investigation found
Ernst & Young, appointed as the court-supervised monitor, examined the company's records and the blockchain. Its June 2019 report included findings that went well beyond a lost password:
- The cold wallets that supposedly held the bulk of customer coins held little or nothing, and in several cases had been empty for years.
- Cotten had used customer deposits for his own trading on other platforms, and had suffered substantial losses.
- He had created fake accounts on QuadrigaCX and credited them with balances that did not exist, which made the exchange look more solvent than it was.
- Payments to withdrawing customers were being funded by other customers' deposits, which is the structure of a Ponzi scheme.
In June 2020 the Ontario Securities Commission published its own report. It concluded that QuadrigaCX had been a fraud, and that Cotten was the sole person behind it. Law enforcement agencies in Canada and the US also looked into the case. Cotten's death was confirmed by a death certificate, and some customers' doubts about it were never supported by evidence. This article does not claim otherwise.
Why it matters
| Issue | What QuadrigaCX showed |
|---|---|
| Key person risk | One person controlling all access is a single point of failure |
| Missing audits | No independent audit or proof of reserves |
| Missing oversight | Canada had no dedicated crypto exchange regime at that time |
| Customer protection | Customers were unsecured creditors in the insolvency |
The role of the court-appointed monitor
In Canadian creditor-protection proceedings, the court appoints a monitor to examine the company's affairs and report to the court and creditors. Ernst & Young did this for QuadrigaCX. Its reports are public, and they are the main source for the findings summarised here. The process also let creditors file claims and vote on how recovered assets would be distributed. Class actions were filed separately by customers. For a business owner, the case is a reminder that unchecked control by a single person is a risk for the company, its customers and any partners. Write down who can access which accounts, and see our security page for access protections on your hosting.
Changes after the case
In Canada, securities regulators moved to require exchanges to register as dealers or marketplaces and to follow rules on custody, and the OSC's report recommended stronger oversight and mandatory safeguards. Exchanges elsewhere began adopting proof-of-reserves practices and independent audits more widely, although what these cover differs from company to company.
The case also added to a lesson from Mt. Gox: holding coins on an exchange means relying on that company. It encouraged more people to learn how to hold their own keys, and it showed the opposite risk, where one person loses access to a wallet. For personal holdings, backups and recovery arrangements are the answer.
Recovery for customers
The monitor recovered some assets, including property and funds held by payment processors, and creditors received partial distributions through the insolvency process. It was far less than what customers were owed. Amounts and timing were set by the court and are available in public filings.
Questions to ask about any custodian
- Who has access to the keys, and what happens if that person is unavailable?
- Is there an independent audit or attestation of holdings and liabilities?
- Which regulator oversees the firm, and what rights do customers have if it fails?
A practical lesson for site owners
Do not let a single person be the only holder of your business's credentials. Store domain, hosting and payment account details in a shared password manager with a documented recovery process. If you ever need help moving or restoring a site, the team at Zebra Hosting can assist; see our contact page.
