Becoming a Quadriga client involved setting up an account on the Quadriga website and using one of several options to fund the account with either fiat or crypto assets. A client who wanted to fund or withdraw from an account using fiat currency would be required to submit a copy of a piece of identification to Quadriga for verification. Once the account was set up, the client could begin trading fiat currency and crypto assets with other clients through the Quadriga website. The platform interface did not provide clients with the names of the counterparties to their trades.
Quadriga started as a platform for trading fiat and Bitcoin, the dominant crypto asset at the time. By the end, crypto assets such as Ether (Ethereum), Ethereum Classic, Litecoin and several Bitcoin forks (Bitcoin Cash, Gold and SV) were added, but Bitcoin remained the platform’s dominant asset. Over the life of the platform, more than 82 per cent of the crypto/fiat volumes traded on Quadriga’s platform were in Bitcoin and Ether. All crypto-to-crypto trading pairs involved Bitcoin because the platform did not offer crypto-to-crypto trades not involving Bitcoin.
As with many other crypto asset trading platforms, trades within the Quadriga platform were not recorded on the blockchain. A crypto asset funding from, or a withdrawal to, a client’s own wallet would be recorded on the blockchain, but client-to-client trades on the Quadriga platform were only recorded in Quadriga’s internal records—which only certain Quadriga personnel could fully view.
Clients depended on Quadriga to fulfill withdrawal requests and deliver their assets.
Custody of Assets
The assets reflected in clients’ Quadriga account balances were held by Quadriga, not its clients. When a client funded an account by transferring assets to Quadriga, the client no longer had control over them. The client was left with only a claim against Quadriga for the value of the transferred assets. The client could then trade this claim with the claims of other clients. In that sense, Quadriga clients were not actually buying and selling crypto assets from one another—they were buying and selling entitlements to receive crypto assets or fiat currency from Quadriga.
For instance, if Client A purchased Bitcoin from Client B in exchange for Canadian dollars, Bitcoin was not delivered to Client A’s wallet and the Canadian dollars were not transferred to Client B. Instead, their Quadriga accounts would be adjusted to reflect their entitlements to claim these assets from Quadriga. In order to get custody of these assets, a client would have to submit a withdrawal request, and the claim would be settled if and when Quadriga delivered the assets to the client. Clients depended on Quadriga to fulfill withdrawal requests and deliver their assets. If Quadriga could not honour a withdrawal request, the client was out of luck: the client had no way of withdrawing assets independently of Quadriga.
In our assessment, this custody model—whereby Quadriga retained custody, control and possession of its clients’ crypto assets and only delivered assets to clients following a withdrawal request—meant that clients’ entitlements to the crypto assets held by Quadriga constituted securities or derivatives. In making this assessment we have relied on CSA Staff Notice 21-327 Guidance on the Application of Securities Legislation to Entities Facilitating the Trading of Crypto Assets (the Staff Notice), which was published by the Canadian Securities Administrators (CSA) in January 2020. Quadriga did not consider its business to involve securities and it did not register with any securities regulator.
Because client assets were in Quadriga’s hands, clients depended on Quadriga to safeguard their assets. In this respect Quadriga billed itself as reliable, claiming on its website that “all funds in the [Quadriga] system are highly liquid, and can be withdrawn at anytime.” In reality, Quadriga’s custody model and practices were flawed, and placed client assets at significant risk of loss, theft and misuse.
Quadriga’s custody model and practices were flawed.
Custody of Crypto Assets
Quadriga did not store a client’s crypto assets specifically for that client. If a client funded an account with a crypto asset, it became part of a general asset pool. In other words, even if a client’s account showed that the client held one Bitcoin, it did not mean that Quadriga was storing that Bitcoin for that client alone, or that Quadriga even held a Bitcoin to back that account entry.
Quadriga’s website promised clients that security was its “number one priority” and assured them that it employed “Cold Storage for the majority of the Bitcoins within our system.” Similar statements were made directly to clients on Reddit, where clients were told that Quadriga used “the tried and tested method of storing 99% coins in cold storage”. In 2018, Cotten claimed in an email that “clients’ cryptocurrency is held in secure and offline multi-signature wallets.” Based on our review, these claims were untrue and misleading. The majority of crypto assets were not held in cold storage. Rather, Quadriga was primarily using a mix of hot wallets and other crypto asset trading platforms to store client assets. Many of these assets were not being stored at all because Cotten was steadily depleting client assets, as discussed in more detail later in this report.
Cold Storage and Multi-signature Wallets
There are different forms of crypto asset wallets, with a variety of features and use-cases. Crypto asset wallets are secured by a 'private key', which is a sophisticated, computer-generated password required by anyone who wishes to access the assets held within the wallet.
A basic crypto asset wallet generates a single private key to access the assets held in the wallet. In contrast, a multi-signature wallet has more than one private key. To access the assets held in the wallet, multiple private keys will be required. These private keys may be given to different individuals to ensure that no single individual has complete control over the assets in the wallet, or that assets may not be moved without the knowledge of others.
Cold storage is essentially an offline crypto asset wallet. As cold wallets are not connected to the internet, they are considered less susceptible to theft via hacking than other storage methods. Cold storage usually involves a dedicated electronic hardware device, like a USB key, that is not connected to the internet, but can also take the form of paper wallets.
These claims were untrue and misleading.
Cotten regularly moved clients’ crypto assets off the Quadriga platform and into accounts he had opened on other crypto asset trading platforms.
From Quadriga’s inception, Cotten had a significant role in handling crypto assets entrusted to Quadriga. In 2016 he became the only person in control of these assets. The evidence shows that Cotten regularly moved clients’ crypto assets off the Quadriga platform and into accounts he had opened on other crypto asset trading platforms. At one point, Cotten told a Quadriga contractor that a certain wallet address was a Quadriga cold storage address, when it was really a deposit address for Cotten’s account at another crypto asset trading platform. We found no indication that Quadriga disclosed this practice of moving assets to external platforms to its clients, so clients were unknowingly subjected to any risks associated with those other platforms. This meant that clients were relying not only on Quadriga’s security and storage practices, but also on the security and storage practices of every other platform on which Cotten stored their assets.
Cotten told a Quadriga contractor that a certain wallet address was a Quadriga cold storage address, when it was really a deposit address for Cotten’s account at another crypto asset trading platform.
Cotten also traded with client assets on those external platforms, which exposed Quadriga to an additional—and undisclosed—trading risk. We were able to obtain records of Cotten’s trading from three of these external platforms, and we determined that he lost $28 million in client assets trading on these platforms. The evidence indicates that he likely traded on other external platforms as well, but we were not able to obtain sufficient information to quantify Cotten’s trading activity on these other platforms. In our assessment, Cotten’s undisclosed and unauthorized trading with client funds was fraudulent.
Quadriga and Cotten left clients in the dark about Quadriga’s custody and storage practices and clients had no ability to confirm independently whether Quadriga had the assets to support client claims, or to monitor how Quadriga was handling clients’ crypto assets. As noted previously, trades within the Quadriga platform were not recorded on the blockchain and the platform itself provided clients with limited information. While transfers of crypto assets from Quadriga to other platforms were recorded on the blockchain, these transactions were recorded under wallet addresses rather than the names of individuals or corporations. These anonymized transactions would not have provided clients with meaningful information about the movement of their assets.
Custody of Fiat Assets
Managing fiat assets was a challenge for Quadriga, especially as the company grew. In the early days Quadriga held client fiat assets in bank accounts, but over time banks began refusing to hold Quadriga-related funds. Cotten became frustrated with the Canadian banking industry. In September 2017, he complained on Reddit that Canadian banks were “incredibly anti-bitcoin” and he expressed an interest in “other options that involve getting the banking system out of it altogether”. By 2017, Quadriga relied almost exclusively on third party payment processors to hold its clients’ fiat assets.
Quadriga also depended on payment processors to transfer fiat currency to and from clients. A patchwork of individuals and companies, some Canadian, some overseas, processed different types of transactions including wire transfers and credit card payments. A total of approximately $800 million flowed in and out of the three largest payment processors alone, earning them millions of dollars in transaction fees.
Quadriga did millions of dollars of business in cash. One of Quadriga’s major clients was a Canadian Bitcoin ATM company. The president of the company would personally deliver suitcases of cash to Cotten to fund his Quadriga account, sometimes using private jets to meet quickly. Ultimately, Quadriga received over $20 million in cash from this ATM company, which Cotten knew, with this origin, would not be accepted by any banks in Canada. He used cash to fund client withdrawal requests by mailing envelopes of cash across the country. The platform data indicates that $14 million of client withdrawals were fulfilled by cash delivery.
Quadriga did millions of dollars of business in cash.
Clients were not provided with meaningful information about Quadriga’s practices regarding the custody and handling of fiat assets. They learned some information about how their own cash amounts were transferred to and from Quadriga, as they followed the steps to fund their own accounts and knew the methods by which their own withdrawals were paid. However, beyond this, they did not have visibility into how the company was handling fiat assets.
The following chart identifies where Quadriga and Cotten held fiat and crypto assets between .
While the evidence shows that many cash deposits and withdrawals were handled by Quadriga directly rather than being routed through payment processors, we were unable to determine with precision when such cash deposits were received and withdrawals paid out. Therefore, these cash amounts are excluded from Chart 1 – Location of assets controlled by Quadriga and Cotten.
Non-Segregation of Assets
Our review confirmed that, from at least 2015, Quadriga did not maintain boundaries between its own assets and those of its clients. Instead of segregating client assets from its own operating funds, Quadriga pooled all funds together and used client assets for its own purposes. For instance, Quadriga and Cotten used client funds to pay operating expenses including contractor fees, IT infrastructure fees and payment processor fees. Client assets were also used by Cotten to cover the trading losses he generated on the platform and to engage in speculative trading on other platforms.
Similarly, there was a lack of segregation between Quadriga/client assets and Cotten’s assets. As discussed in more detail later in this report, Cotten used funds derived from Quadriga to fund his lifestyle without any apparent justification.
Clients were not told that their assets were paying for platform operations or being channelled to Cotten to spend, trade and use as he wished.
How did Cotten’s fake asset trading cause a $115 million loss to Quadriga clients?
Broadly speaking, Cotten engaged in two types of transactions. In one type, Cotten used fake Canadian dollars to purchase real crypto assets. In the second type, Cotten sold fake crypto assets in exchange for real Canadian dollars.
When Cotten used fake Canadian dollars to purchase real crypto assets such as Bitcoin, if the price of the crypto asset went up, the Chris Markay account would profit, but if it went down, the account would suffer a loss. (In substance, this was akin to taking a margined long position on the crypto asset.) This is because the client who sold Cotten real Bitcoin in exchange for fake dollars was entitled to withdraw real Canadian dollars, even though none were involved in the transaction. If Bitcoin prices rose, Cotten could sell that Bitcoin for more than his purchase price, leaving him with enough real Canadian dollars to cover the client’s withdrawal, plus a profit. On the other hand, if Bitcoin prices fell, Cotten would sustain a loss and he would not be able to cover the client’s withdrawal just by selling the Bitcoin he had purchased from the client. He would then take additional assets from Quadriga’s asset pool (i.e. client assets) to cover the client’s withdrawal. The platform would be short by whatever amount he took from Quadriga’s asset pool over and above the amount he could get from selling the Bitcoin. Over time, as discussed later in this report, he did this over and over until Quadriga’s asset pool was almost fully drained.
In the second type of transaction, Cotten sold fake crypto assets in exchange for real Canadian dollars. This type of transaction carried the opposite risk: if the price of the crypto asset went down, the Chris Markay account would profit, but if it went up, the account would suffer a loss. (In substance, this was akin to taking a naked short position on the crypto asset.) For example, when Cotten traded a fake Bitcoin for real Canadian dollars, the client who bought the Bitcoin from him was entitled to withdraw a real Bitcoin, even though none was involved in the transaction. If Bitcoin prices fell, Cotten could use the Canadian dollars to buy a Bitcoin to satisfy that client’s withdrawal, and still have some funds left over. On the other hand, if Bitcoin prices rose, Cotten would sustain a loss. He would not be able to cover the client’s withdrawal just by using the same funds to buy a Bitcoin for the client to withdraw. He would then take additional funds from Quadriga’s asset pool (i.e. client assets) to cover the client’s withdrawal. The platform would be short by whatever amount he took from Quadriga’s asset pool over and above amount of money involved in the original transaction.
Whether Cotten was seeking to profit, generate volume, bolster liquidity on the platform, or had some other purpose, his trading had a catastrophic effect on Quadriga’s finances, and ultimately brought down the entire platform, as discussed in more detail later in this report.
His trading had a catastrophic effect on Quadriga’s finances.