In its recent report, court-appointed monitor Ernst & Young (EY), for QuadrigaCX’s revealed addresses for six of the exchange’s offline latest report by EY suggests that zero might be a more accurate number.
QuadrigaCX was Canada’s biggest cryptocurrency exchange, basically an online service for buying and selling cryptocurrency. Such services also allow users to store cryptocurrency in their system as one might with a traditional stock trading account. Unfortunately, that means if an exchange is hacked or if insiders loot the exchange, users typically lose their funds. But funds can also be lost by forgetting or misplacing one’s key or password because most cryptocurrency is designed to be unrecoverable in such cases. The death of QuadrigaCX founder Gerald Cotten is highlighting that vulnerability because he seems to have taken the company’s digital keys with him.
On February 5th, QuadrigaCX announced on their website that they had received a court order for creditor protection in order to take the “opportunity to resolve outstanding financial issues that have affected our ability to serve our customers.” Ernst & Young Inc. is now their court-appointed monitor and those still working for QuadrigaCX are attempting to recover access to funds that are said to exist but are currently inaccessible.
The backstory
Cryptocurrency exchanges have historically been a huge point of vulnerability for those owning cryptocurrency. Because many users leave their cryptocurrency in exchange accounts, they are targets for both outside and inside attacks. Despite the decentralized design of most cryptocurrencies, exchanges are a centralized point at which such funds can be stolen. Historically speaking, the majority of high-profile thefts, including insider scams, have occurred via such exchanges. Unfortunately, users continue to treat exchanges like banks, despite none of the protections now well-established in the banking industry.
In the case of QuadrigaCX, its status as Canada’s largest cryptocurrency exchange did little to protect users from the loss of their funds. QuadrigaCX was hit with a double centralization whammy. The exchange had all the money and founder Gerald Cotten had the digital keys to most of the exchange’s funds. Problems had already been quite visible in exchange operations but with the death of the founder in early December, which was not revealed until mid-January, much bigger problems emerged.
As long-time cryptocurrency critic David Gerard asked rhetorically, “Remember that time your bank manager died, and suddenly all your money was gone?” Such a question highlights the inherent difference between reasonably secure bank and securities trading accounts and still relatively insecure cryptocurrency exchanges. Unfortunately for everyone involved with QuadrigaCX, founder Cotten’s death and the lost passwords to cold wallets, which are offline devices designed to store crypto passwords, mean that the company is unable to recover the majority of funds which are estimated at around $190 million.
QuadrigaCX had problems
The issue of holding money in a cryptocurrency exchange at a point in history where banks and regulatory organizations are still playing catch-up, added to QuadrigaCX’s many operational issues. One of the biggest issues was the freezing of access to funds held by the Canadian Imperial Bank of Commerce (CIBC). This attempt to store funds in a relatively safe location led to a dispute with CIBC in which the bank claimed to be unable to verify who the funds belonged to despite having been deposited using the bank’s own processes.
(Photo by Blue Coat Photos via Flickr. CC BY-SA 2.0)
Even though QuadrigaCX won in Canadian courts, the money has continued to be withheld through various claims by the bank and the Canadian Bankers Association. However one views this particular problem, it is clear that cryptocurrency users cannot trust the banking industry’s involvement until there is clear government regulation. So QuadrigaCX’s seemingly one smart move was undermined due to what some consider competitive moves by the banking industry.
The death of a founder
But the larger issue for QuadrigaCX was that the exchange was largely administered by a founder from his laptop. Gerald Cotten was the one point of failure. The fact that only he had keys to cold storage accounts was a huge lapse in security and in oversight by anyone in any position of responsibility at QuadrigaCX. It has been widely noted that before his trip to India, where he died, he updated his will as would any smart international traveler. Unfortunately, that very basic move was not accompanied by a move to make sure the company had access to its own funds in the case of his passing.
Since some high-profile cryptocurrency exchange thefts appeared to be insider jobs, in which the founders simply disappeared with the loot, speculation has been widespread concerning the fate of QuadrigaCX funds. A Reddit forum exists for ongoing discussion, independent investigations have occurred and crypto writers are highlighting the more suspicious pieces of the puzzle. However, whatever is discovered about the true fate of QuadrigaCX’s funds, which could include simply being unrecoverable, exchange users may be out any funds they have not received to date. One hopes that this event will encourage cryptocurrency enthusiasts to learn more about crypto security but it seems quite likely that it will simply lead to fewer crypto enthusiasts.
(Featured image by Marco Verch via Flickr. CC BY 2.0)