A Crypto Exchange CEO Dies—With the Only Key to $137 Million

More than 100,000 cryptocurrency holders have learned a hard lesson in finality, after the 30-year-old CEO of a major Canadian exchange died, effectively freezing the company’s assets.

In an affidavit filed in the Supreme Court of Nova Scotia last week, Jennifer Robertson, widow of QuadrigaCX CEO Gerry Cotten, wrote that the company owes its customers $190 million, but can’t access the funds to pay them back. In an unusual setup, Robertson said Cotten was the only person with the cryptographic keys to access $137 million of cryptocurrencies kept in “cold” storage to mitigate the risk of hacks. The remainder is similarly frozen, in cash, by ongoing disputes with a bank and payment processors. The six-year-old company is now seeking protection from its creditors as it attempts to access the lost funds. Robertson’s filing was first reported by Coindesk.

On Tuesday, a Halifax judge granted Quadriga a 30-day stay while it searches for the lost crypto, temporarily shielding the company from lawsuits by customers, some of whom reportedly own millions that are now stranded.

Robertson, who wrote that she has become “significantly more involved in the issues” facing Quadriga since Cotten’s death, says she has his encrypted laptop and USB, which may hold the cryptographic keys to the cold storage funds, but doesn’t have the credentials to log in. She says a search of their Nova Scotia home for her husband’s business records turned up nothing, and attempts to hack the laptop by a security contractor have been unsuccessful. According to the CBC, the hardware will be turned over to an independent court-appointed lawyer.

Robertson revealed Cotten’s death on January 14 in a post on Quadriga’s Facebook page. “Gerry died due to complications with Crohn’s disease on December 9, 2018 while travelling in India, where he was opening an orphanage to provide a home and safe refuge for children in need,” she wrote. Her affidavit says Quadriga’s automated systems continued to accept deposits until January 26, more than a month after Cotten’s death.

Quadriga’s strange tale is just the latest mishap to hit cryptocurrencies. Exchanges, in particular, have been the targets of hackers, racking up billions in losses. To reduce exposure, many custodians of cryptocurrency divide the funds between so-called “hot” wallets, used for day-to-day transactions, and offline “cold” storage, which is much harder for hackers to access.

In this case, that backfired, because Cotten was allegedly the only person with access to the keys. A copy of his will obtained by the Globe and Mail, dated Nov. 27, included $100,000 for the care of his two pet chihuahuas, but apparently no contingency for his personal crypto or business affairs.

“It’s astounding to me that a company of this size can be run with the same accounting procedures of Joe’s Fish ‘n Chips, with a single person in charge and no accountability,” says Emin Gun Sirer, a blockchain adviser and professor of computer science at Cornell University. “That’s far from the norm. It’s not a good look for our industry.”

Tuesday’s hearing offered a glimpse into a one-man accounting operation.

Launched in 2013, Quadriga grew to be one of Canada’s largest exchanges. Michael Patryn, a cofounder of the company who left in 2016, said in a message to WIRED that control of the company’s cold storage crypto had always been centralized. That process didn’t initially spark alarm, Patryn said, because the company had insurance at the time, and its holdings were then relatively small. Large crypto custodians, like exchanges and foundations, typically require multiple people, each with his or her own key, to access funds. Those companies also have backups in case the keys (or the keyholders) are lost, though there are no regulations requiring it. In 2016, all of Quadriga’s directors, apart from Cotten, resigned.

It’s possible, says Sirer, that the laptop and USB could eventually be cracked, or another copy of the keys will be found. In the meantime, customers wondering if they’ll get their money are floating theories of their own. On Reddit, r/QuadrigaCX was swiftly awash in reports of transactions between blockchain addresses theorized to contain the cold storage funds, while users identifying themselves as customers wondered when they would get their money out. Some commentators—including Sirer—questioned whether Cotten had actually died.

A Quadriga customer with CAD$12,640 ($9,606) stranded in the exchange said his ability to make large withdrawals had been curtailed starting last fall. He now believes the frozen funds could be part of a scam, or that the cryptocurrency the company claims to have in cold storage isn’t actually there. “I don’t think I will get the money back and I feel that I have little to no chance to get the truth or justice,” he said.

Robertson, Cotten’s widow, acknowledged the speculation in the affidavit. “There has been a significant amount of commentary on Reddit and other web based platforms about the state of Quadriga, Gerry’s death (including whether he is really dead) and missing coins,” she wrote. She also referred to threats against herself and the company’s director of operations. A lawyer for Robertson did not respond to a request for comment.

A lawyer for Quadriga directed WIRED to a statement posted on the company’s website, noting that Ernst & Young had been named as a monitor for the company. “Filing for creditor protection allows us to work diligently through the process, and to try ensure[sic] the viability of our company,” the company wrote. “We are sure you have many questions. We are in the early stages of a long process and we do not have all the answers right now.”

Robertson’s affidavit included a copy of Cotten’s death certificate, which was corroborated by a Indian government-issued document obtained by Coindesk. Canadian officials also told the CBC that a Canadian had died in India, but could not confirm the identity due to privacy rules.

As for the currency, Sirer says that given the uncertainty, Quadriga should publish the blockchain addresses of its cold storage funds, so customers could monitor the addresses for movements, which shouldn’t occur so long as the sole administrator is dead. “I think it would help with some of the conspiracy theories,” said Patryn. “I would also like to see it.”

In the filing, Robertson wrote that the company would consider a sale of its platform in order to help pay back its customers.