What really happened at QuadrigaCX: the cold wallets that were already empty

When Canada's largest crypto exchange told customers their coins were locked in offline wallets that only its dead founder could open, the story was only half true: the wallets had been emptied months before he died.^[2] This case file covers how QuadrigaCX really lost its clients' money, what regulators found, and the one control that would have exposed it years earlier.

What happened

How it worked

The Ontario Securities Commission published its findings in June 2020 after a 10-month investigation. Its staff concluded that Quadriga's collapse was not a lost-password accident but a fraud run by the founder.^[1]

According to the regulator, he opened hidden accounts on the exchange under aliases and credited them with balances of cash and crypto that did not exist. He then used those made-up balances to trade against real customers, who received the fake assets while handing over real ones. When that trading lost money, new customer deposits were used to cover the gap, which is the basic shape of a Ponzi scheme.^[1] Commentators at the time described it as an old-fashioned fraud with a high-tech wrapper.^[5]

The regulator also found that he took millions of dollars in client assets for his own use.^[1] None of this was visible from the outside because the exchange kept no proper books. Investigators had to rebuild its records from more than 368,000 client accounts and over 6 million transactions, using data from banks and payment processors.^[1]

The key point for any business is that one person had sole control of the customer assets, and no one else ever checked whether the coins the exchange reported actually existed.

What it cost

The commission put client losses at $169 million Canadian, spread across about 76,000 clients, about 40% of them in Ontario.^[1] Roughly $115 million of that came from the founder's fraudulent trading on his own platform.^[1]

No one was prosecuted. The commission said it would not bring enforcement action because the founder was dead and the company was bankrupt, and it noted its findings had never been tested before a court or tribunal.^[1] Its enforcement director said the point of publishing was to help stop this kind of collapse from happening again.^[1]

The bankruptcy dragged on for years. When distributions were finally set, creditors were told to expect about 13% of their claims.^[6]

The missing control

The missing control: independent audits of client asset custody. Nobody outside the founder's control verified, on a regular schedule, that the coins and cash the exchange owed customers were really in its wallets and bank accounts.

A routine reconciliation, done by someone other than the person holding the keys, would have compared what customers were owed with what the company actually held. Empty cold wallets would have shown up in the first check after April 2018, not after a death. Accounts with invented balances would have failed the same test, because their money did not trace back to any real deposit.^[1][2] A second key holder would also have removed the single point of failure that the exchange blamed for its collapse.

What to do in your business

• Reconcile customer money monthly. If you hold deposits, retainers, gift card balances or prepaid funds, compare what you owe against what sits in the account every month, and have someone other than the bookkeeper sign off.
• Never let one person hold the only keys. Bank logins, payment accounts, domain registrars and any crypto wallets should have at least 2 authorized people, with recovery details stored in a sealed, known place.
• Get an outside review. Even a small practice can pay an outside accountant once a year to confirm balances directly with the bank rather than relying on internal reports.
• Watch for accounts nobody can explain. Review user, vendor and customer lists for entries created outside the normal process, and ask who made them.
• Write down who can move money. List every person who can transfer funds and every account they can reach, and make any single-person control a known, time-limited exception.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.