Skip to content
Est. MMXXVIVol. VI · № 273RSS
Blockchain Breaches

An archive of cryptocurrency security incidents — hacks, exploits, bridge failures and rug pulls, documented with on-chain evidence.

Dossier № 007Centralized Exchange Failure

QuadrigaCX Collapse

Canada's largest crypto exchange collapsed when its CEO 'died' in India holding sole access to ~$190M in customer funds; regulators later ruled it a Ponzi.

Date
Status
Funds Stolen
Attribution
Gerald Cotten (alleged)

On January 14, 2019, the family of Gerald Cotten announced that Canada's largest cryptocurrency exchange, QuadrigaCX, was unable to access roughly C$250 million (~$190 million USD) in customer crypto. The reason given: Cotten — Quadriga's 30-year-old CEO — had died of complications from Crohn's disease in India in December 2018, and was the only person who held the passwords and cold-wallet keys. The actual story turned out to be very different.

What happened

On the public timeline, Quadriga was a fast-growing Canadian exchange whose founder kept all sensitive operations on a single encrypted laptop. When Cotten died on a honeymoon trip to India in December 2018 — and the laptop's password could not be recovered, despite a forensic expert hired by his widow — the exchange announced it had no way to access the cold wallets where customer funds were supposedly held.

The Ontario Securities Commission opened an investigation. Court-appointed monitor Ernst & Young followed every on-chain trail. The OSC's June 2020 report reached a different conclusion entirely:

  • The cold wallets contained almost no funds. There were no missing keys to find.
  • Cotten had been running QuadrigaCX as a fraud and Ponzi scheme for years. He used aliases to open in-house accounts, credited those accounts with fictitious balances, and traded against unsuspecting customers — generating real trading losses for the platform while siphoning real cash off the top.
  • Of the $190M shortfall, roughly $115M was the result of fraudulent trading; the remainder was a mix of operational losses, mishandled funds and Cotten's personal spending.

The "dead man with the only key" narrative existed because the actual cold wallets were empty when the music stopped.

Aftermath

  • QuadrigaCX entered creditor protection in February 2019 and was placed in bankruptcy.
  • Some customers received small distributions through the bankruptcy estate; the OSC report quantified the unrecovered loss at the high-100s of millions.
  • Persistent on-chain investigators and a Netflix documentary (Trust No One) kept the story alive into the 2020s; speculation about Cotten's actual fate continues, with periodic petitions to exhume his body.

Why it matters

QuadrigaCX is the canonical case for proof-of-reserves as a regulatory and operational requirement, not a marketing slogan. The fraud was sustainable for years because no customer could verify the exchange held what it claimed to hold. Modern exchange disclosures — Merkle-tree proof-of-reserves, real-time wallet attestations, independent auditor sign-off — are the post-Quadriga industry response, though enforcement remains uneven.

Sources & on-chain evidence

  1. [01]en.wikipedia.orghttps://en.wikipedia.org/wiki/Quadriga_(company)
  2. [02]osc.cahttps://www.osc.ca/quadrigacxreport/
  3. [03]decrypt.cohttps://decrypt.co/5853/complete-story-quadrigacx-190-million

Related filings