Quadriga’s Launch and Platform Operations

Custody of Assets

The assets reflected in clients’ Quadriga account balances were held by Quadriga, not its clients. When a client funded an account by transferring assets to Quadriga, the client no longer had control over them. The client was left with only a claim against Quadriga for the value of the transferred assets. The client could then trade this claim with the claims of other clients. In that sense, Quadriga clients were not actually buying and selling crypto assets from one another—they were buying and selling entitlements to receive crypto assets or fiat currency from Quadriga.

For instance, if Client A purchased Bitcoin from Client B in exchange for Canadian dollars, Bitcoin was not delivered to Client A’s wallet and the Canadian dollars were not transferred to Client B. Instead, their Quadriga accounts would be adjusted to reflect their entitlements to claim these assets from Quadriga. In order to get custody of these assets, a client would have to submit a withdrawal request, and the claim would be settled if and when Quadriga delivered the assets to the client. Clients depended on Quadriga to fulfill withdrawal requests and deliver their assets. If Quadriga could not honour a withdrawal request, the client was out of luck: the client had no way of withdrawing assets independently of Quadriga.

In our assessment, this custody model—whereby Quadriga retained custody, control and possession of its clients’ crypto assets and only delivered assets to clients following a withdrawal request—meant that clients’ entitlements to the crypto assets held by Quadriga constituted securities or derivatives. In making this assessment we have relied on CSA Staff Notice 21-327 Guidance on the Application of Securities Legislation to Entities Facilitating the Trading of Crypto Assets (the Staff Notice), which was published by the Canadian Securities Administrators (CSA) in January 2020. Quadriga did not consider its business to involve securities and it did not register with any securities regulator.

Because client assets were in Quadriga’s hands, clients depended on Quadriga to safeguard their assets. In this respect Quadriga billed itself as reliable, claiming on its website that “all funds in the [Quadriga] system are highly liquid, and can be withdrawn at anytime.” In reality, Quadriga’s custody model and practices were flawed, and placed client assets at significant risk of loss, theft and misuse.

Screenshot from archived site, Jan 6th, 2019.

Custody of Crypto Assets

Quadriga did not store a client’s crypto assets specifically for that client. If a client funded an account with a crypto asset, it became part of a general asset pool. In other words, even if a client’s account showed that the client held one Bitcoin, it did not mean that Quadriga was storing that Bitcoin for that client alone, or that Quadriga even held a Bitcoin to back that account entry.

Quadriga’s website promised clients that security was its “number one priority” and assured them that it employed “Cold Storage for the majority of the Bitcoins within our system.” Similar statements were made directly to clients on Reddit, where clients were told that Quadriga used “the tried and tested method of storing 99% coins in cold storage”. In 2018, Cotten claimed in an email that “clients’ cryptocurrency is held in secure and offline multi-signature wallets.” Based on our review, these claims were untrue and misleading. The majority of crypto assets were not held in cold storage. Rather, Quadriga was primarily using a mix of hot wallets and other crypto asset trading platforms to store client assets. Many of these assets were not being stored at all because Cotten was steadily depleting client assets, as discussed in more detail later in this report.

From Quadriga’s inception, Cotten had a significant role in handling crypto assets entrusted to Quadriga. In 2016 he became the only person in control of these assets. The evidence shows that Cotten regularly moved clients’ crypto assets off the Quadriga platform and into accounts he had opened on other crypto asset trading platforms. At one point, Cotten told a Quadriga contractor that a certain wallet address was a Quadriga cold storage address, when it was really a deposit address for Cotten’s account at another crypto asset trading platform. We found no indication that Quadriga disclosed this practice of moving assets to external platforms to its clients, so clients were unknowingly subjected to any risks associated with those other platforms. This meant that clients were relying not only on Quadriga’s security and storage practices, but also on the security and storage practices of every other platform on which Cotten stored their assets.

Cotten told a Quadriga contractor that a certain wallet address was a Quadriga cold storage address, when it was really a deposit address for Cotten’s account at another crypto asset trading platform.

Cotten also traded with client assets on those external platforms, which exposed Quadriga to an additional—and undisclosed—trading risk. We were able to obtain records of Cotten’s trading from three of these external platforms, and we determined that he lost $28 million in client assets trading on these platforms. The evidence indicates that he likely traded on other external platforms as well, but we were not able to obtain sufficient information to quantify Cotten’s trading activity on these other platforms. In our assessment, Cotten’s undisclosed and unauthorized trading with client funds was fraudulent.

Quadriga and Cotten left clients in the dark about Quadriga’s custody and storage practices and clients had no ability to confirm independently whether Quadriga had the assets to support client claims, or to monitor how Quadriga was handling clients’ crypto assets. As noted previously, trades within the Quadriga platform were not recorded on the blockchain and the platform itself provided clients with limited information. While transfers of crypto assets from Quadriga to other platforms were recorded on the blockchain, these transactions were recorded under wallet addresses rather than the names of individuals or corporations. These anonymized transactions would not have provided clients with meaningful information about the movement of their assets.

Custody of Fiat Assets

Managing fiat assets was a challenge for Quadriga, especially as the company grew. In the early days Quadriga held client fiat assets in bank accounts, but over time banks began refusing to hold Quadriga-related funds. Cotten became frustrated with the Canadian banking industry. In September 2017, he complained on Reddit that Canadian banks were “incredibly anti-bitcoin” and he expressed an interest in “other options that involve getting the banking system out of it altogether”. By 2017, Quadriga relied almost exclusively on third party payment processors to hold its clients’ fiat assets.

Quadriga also depended on payment processors to transfer fiat currency to and from clients. A patchwork of individuals and companies, some Canadian, some overseas, processed different types of transactions including wire transfers and credit card payments. A total of approximately $800 million flowed in and out of the three largest payment processors alone, earning them millions of dollars in transaction fees.

Quadriga did millions of dollars of business in cash. One of Quadriga’s major clients was a Canadian Bitcoin ATM company. The president of the company would personally deliver suitcases of cash to Cotten to fund his Quadriga account, sometimes using private jets to meet quickly. Ultimately, Quadriga received over $20 million in cash from this ATM company, which Cotten knew, with this origin, would not be accepted by any banks in Canada. He used cash to fund client withdrawal requests by mailing envelopes of cash across the country. The platform data indicates that $14 million of client withdrawals were fulfilled by cash delivery.

Clients were not provided with meaningful information about Quadriga’s practices regarding the custody and handling of fiat assets. They learned some information about how their own cash amounts were transferred to and from Quadriga, as they followed the steps to fund their own accounts and knew the methods by which their own withdrawals were paid. However, beyond this, they did not have visibility into how the company was handling fiat assets.

The following chart identifies where Quadriga and Cotten held fiat and crypto assets between May 2017 and February 2019 (Open footnote).

Non-Segregation of Assets

Our review confirmed that, from at least 2015, Quadriga did not maintain boundaries between its own assets and those of its clients. Instead of segregating client assets from its own operating funds, Quadriga pooled all funds together and used client assets for its own purposes. For instance, Quadriga and Cotten used client funds to pay operating expenses including contractor fees, IT infrastructure fees and payment processor fees. Client assets were also used by Cotten to cover the trading losses he generated on the platform and to engage in speculative trading on other platforms.

Similarly, there was a lack of segregation between Quadriga/client assets and Cotten’s assets. As discussed in more detail later in this report, Cotten used funds derived from Quadriga to fund his lifestyle without any apparent justification.

Clients were not told that their assets were paying for platform operations or being channelled to Cotten to spend, trade and use as he wished.