Cryptocurrency exchange loses access to $145m of user funds

A collection of cryptocurrency tokens in their physical manifestations

Canada's largest cryptocurrency exchange QuadrigaCX has lost $145 million worth of cryptocurrency after its CEO died, taking the private key to a company cold wallet with him.

The company has filed for legal protection against its creditors in accordance with Canadian law while it continues to attempt to regain access to the funds.

As part of the filing, Jennifer Robinson, the widow of late company CEO Gerry Cotten who died of Chron's disease in Jaipur, India in December 2018, filed an affidavit saying that Cotten had sole access to the cold wallet containing the massive amount of cryptocurrency the exchange needed to conduct business.

"The normal procedure was that [Cotten] would move the majority of the coins to cold storage as a way to protect the coins from hacking or other virtual theft," the affidavit read.

A cold wallet is one that stores cryptocurrencybut is not connected to the internet and is therefore safe from any cyber heists. It's a popular security measure taken by other exchanges such as Binance and Coinbase.

Usually, there are failsafe measures in place in the form of multi-signature systems that allow companies to regain access to cold wallets in the event that they become inaccessible by others. This isn't the case with QuadrigaCX, though.

Despite losing access to the funds in December, QuadrigaCX continued to operate for nearly a month using liquid assets stored in hot wallets and fiat currency accounts.

It's understood that QuadrigaCX hired an outside IT consultant to try and decrypt Cotten's laptop in the hope that the cold wallet password was stored on it, to no avail.

According to the Affidavit originally acquired by CoinDesk, the lost funds comprised a range of cryptos including Bitcoin, Bitcoin Cash, Litecoin and Ethereum. The wallet held just shy of 430,000 Ethereum tokens which equates to roughly 0.5% of all Ether in existence, according to one market analyst.

"For the past weeks, we have worked extensively to address our liquidity issues, which include attempting to locate and secure our very significant cryptocurrency reserves held in cold wallets, and that are required to satisfy customer cryptocurrency balances on deposit, as well as sourcing a financial institution to accept the bank drafts that are to be transferred to us," said QuadrigaCX in a company announcement. "Unfortunately, these efforts have not been successful. Further updates will be issued after the hearing."

The company also owes another $53.5 million in fiat currency which it cannot pay after using some of its reserves and Canadian authorities freezing other accounts, according to AMBCrypto.

Robertson initially announced the death of her husband on Reddit which prompted a mass withdrawal of funds from the exchange and tempers to continue to rise as more users lose access to their funds.The situation highlights how it is becoming more prevalent for people, especially those in high-level business positions, to have a will that addresses how their digital data, accounts and profiles are managed after they pass away.

For example, one might wish for their Facebook profile to be disabled once they are dead, or for cryptocurrency wallets and paid-for subscription services, say Office 365, to be passed on to their next of kin.

However, while some online services allow for next of kin to handle the digital affairs of the person who's passed away, others have yet to offer such services.

As such, we can expect to see similar situations to Cotten's crop up as more people tap into increasing amounts of digital services and online currency exchanges, yet have no will that contains passwords, credentials and authorisation to allow a beneficiary to them over, potentially leaving all manner of digital money, subscription services and social media profiles in a state of online limbo.

Connor Jones
Contributor

Connor Jones has been at the forefront of global cyber security news coverage for the past few years, breaking developments on major stories such as LockBit’s ransomware attack on Royal Mail International, and many others. He has also made sporadic appearances on the ITPro Podcast discussing topics from home desk setups all the way to hacking systems using prosthetic limbs. He has a master’s degree in Magazine Journalism from the University of Sheffield, and has previously written for the likes of Red Bull Esports and UNILAD tech during his career that started in 2015.