Worked example · 2019-01

QuadrigaCX exchange collapse — multi-chain — 2019-01 to 2019-04

Loss

approximately C$214.6M claimed by 76,319 unsecured creditors (EY monitor, as reported), of which EY had secured about C$33M by June 2019. The OSC's June 2020 report found clients lost at least $169M (currency not stated in the report coverage), about $115M of it from Cotten's fraudulent trading, with $28M lost by Cotten on other exchanges and $46M recovered; about 76,000 investors were affected (BetaKit). QuadrigaCX announced CEO Gerald Cotten's death and its insolvency in January 2019, owing clients roughly C$250M (Bitcoin Magazine).

OAK Techniques observed

OAK-T11.005.002 (Fake-Custodian / Fake-Asset-Manager Fraud) — primary classification; QuadrigaCX presented as a legitimate exchange with offline reserves while the operator commingled and redirected customer deposits. OAK-T5.005 (Treasury-Management Exit) — operator-side extraction through commingling and fraudulent trading. OAK-T11.001 (Third-Party Signing Vendor Compromise — broadly construed; the custodian itself was the failure surface).

Attribution

confirmed — QuadrigaCX founder Gerald Cotten, publicly identified by the Ontario Securities Commission as running the fraud. The Ontario Securities Commission's June 2020 report classified Cotten's conduct as a Ponzi scheme (BetaKit). EY's monitor reports found no segregation between QuadrigaCX and user funds, fake accounts used to trade non-existent funds with real users, and transfers to personal accounts at other exchanges (as reported by Business Standard / CBC).

Corrected 2026-10-11

removed unsourced figures (coin quantities owed, "~104 BTC in cold wallets", 115,000 users, named exchanges and luxury-spending details, 13-15% distribution, CSA Staff Notice 21-327 causation, CFTC/FBI investigations, Netflix documentary, specific death/bankruptcy/monitor-appointment dates); replaced with EY/OSC figures from cited coverage.

Key teaching point

QuadrigaCX is a worked example of the sole-operator custody anti-pattern: one individual with sole knowledge of the offline-wallet passwords, no segregation of customer and company assets, and an operator trading customer funds. Reporting on the monitor's work says many associated wallets held a very small fraction of what was owed and had been drained months before Cotten's reported death, so the lost passwords were not the root cause of the shortfall.