QuadrigaCX: Behind the Founder's Death, the Other Answer a Regulator's Report Found
In February 2019 a Canadian exchange shut its doors. The version that travelled furthest went like this: the founder died in India, the keys to the cold wallets died with him, and nobody could ever open them again. More than a year later, the enforcement branch of the Ontario Securities Commission turned a ten-month review into a public report, and one sentence in it is aimed squarely at that version: "In our assessment, this was not the case." This volume is about the answer the report gave instead.
QuadrigaCX's money was not, for the most part, locked in cold wallets by its founder's death. The review report published by Ontario Securities Commission (OSC) staff in June 2020 says that more than 76,000 clients were owed about $215 million in assets and lost at least $169 million in the end (amounts as stated in the report, in Canadian dollars), and that about $115 million of that came from founder Gerald Cotten's fraudulent trading on his own platform. He opened accounts under aliases, credited himself with fiat and crypto balances that did not exist, and traded those balances with real clients who had no idea. When prices moved, the losses were real, and he covered them with other clients' deposits. The report's verdict on that structure is that Quadriga "operated like a Ponzi scheme".
This volume deals with a single document. The enforcement branch of a securities regulator spent roughly ten months analysing trading data and blockchain data, interviewing key witnesses and working with regulators inside and outside Canada, then published what it found as a public report. Near the start of that report is a sentence aimed directly at the popular version.
The popular version, and the report's version
The timeline runs like this. On January 14, 2019, Quadriga announced that Cotten had died in India the previous month. By February 5 the platform had stopped operating and applied for creditor protection. From an obituary to a closed exchange took three weeks.
The explanation that spread furthest afterwards was that he alone held the wallet keys: the man was gone, so the keys were gone, and clients' coins would sit on-chain forever, untouchable. It is an easy story to remember, and it fits what outsiders imagine about crypto: the technology went wrong and nobody could do anything about it.
OSC staff did not see it that way. The report's Executive Summary says: "It has been widely speculated that the bulk of investor losses resulted from crypto assets becoming lost or inaccessible as a result of Cotten’s death. In our assessment, this was not the case. The evidence demonstrates that most of the $169 million asset shortfall resulted from Cotten’s fraudulent conduct."
One thing needs to be said clearly at the start of this volume: these are the review findings of regulatory staff, not findings of a court. The report carries its own disclaimer: "the findings and views in this Report are not findings of fact by an OSC hearing panel and have not been tested before the OSC tribunal or a court." Read every "the report says" below in the light of that sentence.
How big the hole was
The report gives a set of figures that reconcile with one another. The amounts below are as stated in the report, in Canadian dollars.
- More than 76,000 clients were owed a combined $215 million or so in assets.
- About 40% of them lived in Ontario — and this report comes from Ontario's own securities regulator.
- The bankruptcy trustee, Ernst & Young, recovered or identified only about $46 million in assets available to pay clients.
- Those who entrusted assets to Quadriga lost at least $169 million in total.
$215 million minus $46 million is exactly $169 million. This paragraph is my own reading: what that subtraction tells you is that the money was not "temporarily unreachable"; it was genuinely gone. If the loss really had been just a matter of missing keys, the trustee would have been looking at a pile of on-chain assets whose location was known but which could not be moved. That is a different kind of ledger, not this one.
The breakdown of the shortfall the report discloses happens to separate those two kinds of ledger. The next section covers the pieces it lists.
Where the money went
The report breaks the $169 million shortfall into several pieces, and each one is different in kind.
The largest piece, about $115 million, came from Cotten's fraudulent trading on the Quadriga platform. He opened accounts on his own platform under aliases, credited those accounts with fictitious fiat and crypto balances, then used those balances to trade with clients who did not know. A fictitious balance is only a number in a database, but the trades were real: whenever crypto prices moved, he incurred real losses. There was no real money to cover them, so he used other clients' deposits. At this point the report sums it up: "In effect, this meant that Quadriga operated like a Ponzi scheme."
The second piece: $28 million. This is what he lost trading client assets on three outside crypto asset trading platforms, without client authorization and without disclosing it to clients.
The third piece, which the report puts as "millions". These are client assets misappropriated to fund his personal lifestyle.
Then there is the state of things at the end. In the report's words, in its final months Quadriga had almost no assets left and operated like a revolving door: "new client deposits were immediately re-routed to fund other clients’ withdrawals."
The revolving-door image is worth pausing on. A revolving door looks as if it is always turning, people coming and going in good order; only when there turns out to be nothing behind it do you learn what it was turning on. On the user's side, a withdrawal that arrives is the strongest proof of trust there is, and it is exactly the indicator that stays normal in this kind of structure right up until it collapses.
Why nobody stopped it
The report is blunt on this point. Quadriga did not consider its business to involve trading in securities, and it was not registered with any securities regulator. That lack of registration made it easier for Cotten to carry out large-scale fraud without being detected.
The other half of the reason lay inside the company: nobody provided any oversight of Cotten. According to the report, from 2016 he alone controlled a company with hundreds of thousands of clients, handling more than a billion in fiat-denominated assets and more than five million units of crypto assets. One man, one set of books, no second pair of eyes.
What could anyone on the user's side actually see? The report says Quadriga gave no meaningful information about how those assets were stored, moved and used; instead, it gave false assurances about how they were stored. Clients had no means of checking those claims, and no access to substantive information about what was being done with their assets.
This is the part of the report today's users most need to take in. Did the people back then do anything wrong? They kept their coins at an exchange that looked as if it was running normally, paid out withdrawals normally and publicly claimed its assets were safely held. In 2018 an ordinary user had almost no widely used way of verifying any of that.
Why the OSC brought no enforcement case
So the facts were established. What then? The OSC's answer was that there would be no enforcement proceedings on its side, and the reason is in the text: "this is not practical given that Cotten is deceased and Quadriga is bankrupt, with its assets subject to a court-supervised distribution process."
The man was gone and so was the company. There was nobody left to prosecute, and the remaining assets had already entered a court-supervised distribution process that fell far short of filling the hole. So the document never became an indictment. It became a public review record instead: it has Findings, a dedicated section on where the money went, and a section called Regulatory Takeaways about what the case leaves for regulators.
For an archive, that kind of document is actually more useful. An indictment only answers "who is responsible"; a review record answers "how did this come about, step by step".
Three footnotes from the Keeper
This section is my own judgement, not the report's findings. Keep the two apart.
I. The report wrote its own best summary
The line in the report that sums it up is: "What happened at Quadriga was an old-fashioned fraud wrapped in modern technology."
I read that sentence as a caption for the whole Shipwreck Annals series. Fictitious balances, plugging your own hole with client deposits, paying old withdrawals with new money: all of these are centuries older than blockchains. Crypto only changed the vehicle. Money moves in and out faster, accounts are easier to open, crossing borders involves less friction, and fewer people can read the books. Technology changed the speed and the scale. It did not change the structure.
II. The "no way to verify" of back then has a name today
The sharpest line in the report is that clients "had no means of verifying these claims". That is exactly what our explainer What Is Proof of Reserves (PoR)? is about: turning "your assets are safe with us" from a promise into evidence that outsiders can check for themselves.
To be clear, proof of reserves is not a cure-all. The questions it can answer are limited, and the moment it answers them carries a timestamp. But put the Quadriga file next to the definition of PoR and a very plain cause and effect appears: what was missing back then was not a sterner slogan, but a check an ordinary user could run on their own.
III. Hold it up against the selection checklist
Quadriga is one of the cases in our piece 5 Sieves to Pick a Crypto Exchange, which distils five selection criteria from eight exchange collapses. Put the facts from this volume back into that checklist and several red lights were already on in 2018: one person in sole control of the company, no registration with any securities regulator, no proper books or internal oversight, and no verifiable information at all about how assets were held.
To see where it sits on the full timeline, look for the 2019 entries in The Complete Crypto Black Swans History. The ships in the previous volumes each sank in their own way, but the hole in the hull was always in the same place.
- Ontario Securities Commission staff report "QuadrigaCX: A Review by Staff of the Ontario Securities Commission" (published June 2020), Executive Summary of the web version, www.osc.ca/quadrigacxreport. All figures and quotations in this volume come from that page, opened and checked in September 2026.
- The report's disclaimer, in the original: "the findings and views in this Report are not findings of fact by an OSC hearing panel and have not been tested before the OSC tribunal or a court."
- The Quadriga entry in this archive's Complete Crypto Black Swans History (timeline and events of the same period).
If you spot a factual error in this file, please write to [email protected] — I will issue a public correction and credit you by name. The full correction history lives at /corrections.html.