The curious case of QuadrigaCX

Following the somewhat mysterious death of its founder Gerald Cotten, QuadrigaCX has revealed it cannot gain access to any of its cold wallets where customer funds were allegedly stored — leaving its users high-and-dry and potentially 190 million unaccounted for.

This news comes on the heels of the hack experienced by New Zealand’s leading crypto asset exchange Cryptopia. The troubling circumstances surrounding these two exchanges are fodder for those who believe the sector will benefit from greater regulatory oversight.

A suspicious death

The ‘QuadrigaCX saga’ continues to draw attention from both the cryptocurrency sector and mainstream media. The curious circumstances surrounding Cotten’s death can be characterized as confusing at best and suspicious at worst. However, as more details begin to emerge, it is becoming clear that the Canadian exchange’s troubles did not begin with its founder’s death but much earlier.

Cotten and his wife, Kathleen Robertson, arrived in Jaipur, India on December 8, 2018. The couple had traveled there to participate in activities connected to a children’s orphanage, which they were allegedly supporting. However, shortly after checking in to the luxury Oberoi Rajvilas hotel, Cotten developed a stomach ache and was taken to the Fortis Escorts private hospital in Jaipur, according to a report by The Globe And Mail.

Cotten’s hospitalization is credited to complications arising from Crohns Disease, an inflammatory disease of the digestive tract which he had been diagnosed with years earlier. Cotten’s condition deteriorated rapidly and he was pronounced dead on December 9 with the official cause of death revealed to be cardiac arrest. Robertson, Cotten’s widow, returned to Canada on December 10. A funeral was held at JA Snow Funeral Home in Halifax Nova Scotia on December 14th.

The death of Cotten has raised a number of questions, starting with irregularities around the legal documents used to verify it. The death certificate viewed by media house The Globe And Mail lists the place of death as the Oberoi Rajvilas hotel, while another death certificate, published by blockchain news publication _CoinDesk, _lists the place of death as Fortis Escorts hospital.

Additionally, there are questions about how a 30-year-old man could develop serious complications from a disease he had been managing for years and then die in just a matter of hours. Dr. Jayant Sharma, the gastroenterology doctor who took lead with Cotten during his time at Fortis Escorts hospital, remarked that while they were sure he had died, the circumstances around his demise were "medically unusual."

Moreover, Simmi Mehra, an embalmer at Mahatma Gandhi Medical College & Hospital, another private hospital, refused to embalm Cotten’s body in preparation for its return to Canada. Mehra found it suspicious that the body would be brought from a hotel as opposed to in an ambulance from a hospital as is customary. However, she also added that as a private embalmer she is generally very cautious. She directed the body to a public hospital where it was eventually embalmed. Cotten’s body was picked up by the hospital’s staffers from the couple’s hotel.

It is important to mention that prior to their India trip Cotten had written a will leaving all of his belongings to his wife, including a number of real estate holdings, cars, a yacht and his majority stake in the company which owns QuadrigaCX. The will was prepared on 27 November, only three days before the couple left for India.

Moreover, there are reports that it is relatively easy to forge death certificates in India which have fueled the faked death/exit scam narrative. However, the Times of India story above deals with Indian nationals – presumably well versed in the practicalities of embarking on such a fraud in their home country. But how likely is it that a vacationing Canadian could pull off such an endeavor?

Not very, says Guneet Chaudhary, managing partner of Chandigarh law firm Jurisconsultus. "I have yet to hear a case where an Individual has faked his death and got a death certificate from the medical authorities. In the case of foreigners, it is very strict as the death certificate is given only after the Board of Doctors, and generally, a Civil Surgeon of the District examines and confirms the identity of the person. The concerned embassy is informed about the death and the embassy also certifies the identity of the person."

Trouble with the business

As mentioned earlier, Cotten’s death is not the only strange happening in the QuadrigaCX case. The Canadian exchange is no stranger to controversy and is currently involved in a number of lawsuits. Many of the suits involve banks and other traditional financial institutions who have taken issue with the financial practices of the exchange.

One bank, CIBC, froze one of the accounts used by the exchange to move money – on the grounds that it was unsure who the funds held actually belonged to. At the time, Quadriga explained that the freeze was why some users had been unable to withdraw money from the platform. It further claimed it would take legal action against CIBC because of the damage caused when it froze the accounts.

On December 4th, the courts reportedly ruled that the 22 million in question should be released. However, no bank was willing to accept the bank drafts issued by CIBC leaving Quadriga’s customers in the same position. Following this turn of events, QuadrigaCX continued to accept new customers and process trades. Moreover, the platform did not inform its users once its CEO died and continued to operate as normal with the knowledge that it did not have enough liquidity to repay its customers.

In an affidavit used in the creditor protection filing sent in by QuadrigaCX, Kathleen Robertson explained that Cotten was the only person who controlled the flow of money into and out of the platform’s accounts and that he was the only one who could access the cold wallets through the private keys.

The Halifax Supreme Court has granted QuadrigaCX protection from its creditors until March 7th

The courts granted QuadrigaCX a stay of 30 days at which point the exchange announced the move on its website, stating that it had decided to request creditor protection because it anticipated it would take a significant amount of time to resolve its financial issues and wanted to avoid legal action in the interim.

Unfortunately, the situation worsened when it was revealed that Quadriga had sent a further 103 bitcoin to Cotten’s wallet long after his death. Ernst and Young, appointed by the court as a third party overseer, revealed that an employee had "inadvertently" sent the funds on February 6, 2019.

Moreover, the claims that the exchange held its users’ funds in some sort of mass cold storage are in doubt. Speaking on the Unchained Podcast, Taylor Monahan, the CEO of MyCrypto, explained that she had examined the wallet addresses that QuadrigaCX had routinely used and there was no evidence of large scale crypto holdings — and while she acknowledged it was possible, she said it was unlikely the exchange had any large holdings in a cold storage wallet.

Other peculiarities in the QuadrigaCX case include the fact that Cotten’s wife has changed her name a number of times and owns properties under several different names. Additionally, prior to notifying Quadriga’s customers of her husband’s death, she moved to protect their assets by moving them into a trust. Lastly, one of the board members and founding partner of FinTech, the company that owns Quadriga, who goes by the name of Michael Patryn is suspected to be Omar Dhanani – a convicted criminal who served a jail sentence in the US for money laundering.

Despite all the irregularities surrounding Cotten’s death and the operation of the QuadrigaCX exchange, it appears that Canadian police have no plans to investigate and for now the missing funds remain a civil, rather than criminal, matter. In terms of what happens next, the order for creditor protection will survive for 30 days – ending on March 7th. At this time QuadrigaCX users who have lost crypto would be able to file suit against the company unless the court extends its creditor protection. Prior to that, though, applications for relief and the appointment of lawyers for QuadrigaCX’s creditors (including holders of both fiat and crypto deposits) were heard in the Halifax Supreme Court on the 14th of February.

A hearing to assign representation for QuadrigaCX creditors was held on February 14th.

Predictably, social media chatter has been alive with exit scam theories since the news of Cotten’s death broke. While that point of view is understandable, the fact remains there has been no evidence of an ‘exit’ by Kathleen Robertson or other significant players in the QuadrigaCX business. By all accounts the company is following the required process under Canada’s Companies’ Creditors Arrangement Act. Court appearances have happened, monitors (Ernst & Young) have been appointed, and lawyers have been assigned to represent the company’s creditors. While there remains much to be discovered, the whole sorry affair may actually be just as advertised. That is, a very wealthy young man managed his business carelessly, and thousands of people lost their money as a result. It wouldn’t be the first time.

Meanwhile, down under

In New Zealand, recently hacked exchange Cryptopia revealed that it has been cleared by local authorities to resume operations. Despite this the exchange remains closed at the time of publication. Cryptopia has remained silent on most of the details of the hack, only stating on its website (in a message that has been unchanged since January 14th) that its platform had fallen to a security breach, losses were significant and the exchange had been put into maintenance.

Blockchain analytics company Elementus, though, has published a thorough report on the hack. According to Elementus, the attackers made off with $16 million worth of ETH and other ERC20 tokens. Additionally, the firm revealed that the hackers must have gained access to the private keys associated with all of the wallets used by the exchange to process transactions.

Once again this brings into question the practices employed by exchanges when dealing with private keys. Similarly to QuadrigaCX, it appears Cryptopia, like so many other hacked exchanges in recent years, was not operating in a manner that sufficiently focused on appropriate private key management to secure its customers’ funds.