Curriculum·G401 Custody Operations and Key Ceremonies·about 31 min
The single key, and QuadrigaCX
By the end of this lesson you can
- →State why a single key holder is a single point of failure for an institution, not a convenience
- →Explain how QuadrigaCX's sole-key custody story left about 184 million Canadian dollars declared inaccessible
- →Compute the failure modes a single key exposes: death, departure, coercion, and loss
- →Judge a custody arrangement by what happens when the one person is gone
Graduate · enrolled learners
This lesson opens with QuadrigaCX, 2019.
- What happened
- QuadrigaCX was Canada's largest cryptocurrency exchange. In December 2018 its founder, Gerald Cotten, died, and the company stated he had been the only person with the keys to its cold wallets, so the roughly 184 million Canadian dollars of customer crypto thought to be in those wallets was declared inaccessible. The cold wallets were found to have been emptied before Cotten died, most of them in April 2018, and staff of the Ontario Securities Commission concluded the exchange had in truth operated like a Ponzi scheme: clients lost at least 169 million Canadian dollars, most of the shortfall caused by Cotten's fraudulent conduct, the bulk of it his own trading on the Quadriga platform, and not by a lost key. The story of a lost key was a cover for a hole that already existed. But the arrangement the public was told, and that customers believed, is itself the lesson: an exchange that lets one person hold the only key has built a structure where a single death makes customer funds unrecoverable, and the fraud was only able to hide behind that structure because the structure was plausible.
- The decision point
- The QuadrigaCX story worked as a cover precisely because a single key holder is a recognizable and common failure, and an institution's first custody decision is to make sure it never applies to them. A single key is not a small operational risk; it is a structure in which the death, departure, incapacity, or coercion of one person, or the simple loss of one device or phrase, makes the assets gone. Institutional custody exists to remove the single point of failure: no one person can move the assets alone, and no one person's absence can freeze them. That is the property to design for, and the test of any custody arrangement is the blunt question QuadrigaCX poses, what happens to the assets if the one person who can reach them is gone tomorrow. If the answer is that they are lost, the arrangement is QuadrigaCX regardless of who runs it.
- Recorded loss
- $126,000,000
What you will be able to answer
- →What did QuadrigaCX show about single-key custody?
- →What failure modes does a single key expose?
- →What property does institutional custody provide?
- →What is the blunt test for the QuadrigaCX flaw?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.osc.ca/quadrigacxreport/index.html
- https://www.theregister.com/offbeat/2019/03/07/while-this-ceo-may-be-stiff-his-customers-are-rather-stuffed-quadriga-wallets-finally-cracked-open-nothing-inside/360625
- https://www.coindesk.com/markets/2020/06/11/quadriga-was-a-ponzi-scheme-ontario-securities-regulator-says
Confidence high·Volatility low·Reviewed 2026-09-16·Owner unassigned
Contested
Accounts of the amount differ. In March 2019 The Register reported about 184 million Canadian dollars (about 137 million US dollars) of client crypto thought to be in cold storage and about 190 million US dollars owed to clients in total, and CoinDesk in 2020 described close to 200 million dollars of missing customer funds. The OSC's June 2020 report puts the client loss at at least 169 million Canadian dollars, which this lesson uses as the loss; loss_usd converts it at the exchange rate The Register's own figures imply. The OSC concluded the shortfall was caused principally by fraud, not by a lost key.
The OSC report is a review by OSC staff, and it says its findings are not findings of fact by an OSC hearing panel and have not been tested before the tribunal or a court. It puts the amount owed at a combined 215 million Canadian dollars to over 76,000 clients, of which the bankruptcy trustee, Ernst & Young, recovered or identified 46 million Canadian dollars; the shortfall it attributes to fraud is 169 million, of which about 115 million arose from Cotten's trading on the platform and a further 28 million from his unauthorized trading on three outside platforms.
This lesson uses QuadrigaCX for the single-point-of-failure structure that the sole-key story described; whether every dollar was lost to fraud versus inaccessibility does not change the custody lesson.