QuadrigaCX looted via Star Wars-themed dummy accounts, phantom trades

The fifth report of the trustee for failed cryptocurrency exchange QuadrigaCX is in, and you’ll be shocked—shocked!—to learn that the late Gerald Cotten was a crook.

The Canadian exchange imploded after somewhat vague reports of Cotten’s sudden death in India on December 9 led to revelations that no one had the passwords to QuadrigaCX’s cold storage wallets. At the time, it was believed that this had left about $160 million worth of fiat and cryptocurrency permanently frozen and therefore irretrievable.

However, as the latest and longest report by court-appointed bankruptcy trustee Ernst & Young makes clear, the exchange had already been looted by the only person with access to its accounts, wallets, and (very minimal) records: Cotten.

According to George Kinsman, the E&Y senior vice president acting as monitor, about $138 million is missing and about $25.4 million recovered or recoverable for the approximately 76,000 QuadrigaCX customers Cotten robbed.

A large but unspecified amount appears to have been lost by Cotten’s exceptionally poor skills as a cryptocurrency margin trader. And about $60 million was transferred to another exchange and subsequently withdrawn, with its location unknown.

Trading with Mr. Aretwo Deetwo

Any question about whether Cotten’s intentions were ever good can be addressed by looking at two points in Kinsman’s report.

First of all, the QuadrigaCX platform was intentionally designed so that no access logs were kept of any activity by those with full administrator privileges—Cotten and the site’s designer.

“The Monitor was advised that the decision not to record Mr. Cotten’s administrative activities was done at his request,” Kinsman reported, adding, “access log tracking activity by all administrators, even those with the highest levels of access is a common and expected feature of any software application.”

Second, Cotten did not always require “know your customer” (KYC) data from QuadrigaCX clients, and a number of those accounts were controlled by him under various pseudonyms, including the Star Wars-themed names Aretwo Deetwo and Seethree Peaohh.

A third such account, under the more realistic name of Chris Markay, recorded deposits of more than $220 million in fiat, as well as 34,806 bitcoins (BTC) and 540,011 ethers (ETH)—worth $325.6 million and $145 million, respectively, at current prices—between 2016 and 2018. Only about 1% of those deposits were backed by any documentation, leading Kinsman to surmise that they were fake.

The funds in this phantom account, “were used to facilitate trades within the platform and to withdraw real cryptocurrency from Quadriga,” about 300,000 times,” said Kinsman. Not only did this create the appearance of far higher trading volumes on QuadrigaCX than actually existed, the Markay funds were used as a trading partner with real customers, allowing Cotten to exchange real assets for phantom ones, and to charge customers trading fees while doing it.

Kinsman added, “large volumes of cryptocurrency were withdrawn from Quadriga through the Chris Markay account. It appears that although the Chris Markay account may have been funded with [phantom] deposits, real cryptocurrency was transferred out.”

Where it all went

First of all, the money looted from QuadrigaCX customers supported a luxury lifestyle for Cotten and his wife. His personal assets at the time of his death were valued at about $9.1 million, including cash and investments, homes in Nova Scotia and British Columbia, a yacht, a private airplane, luxury cars, and gold and silver coins. While they are still in his wife’s possession, they have been frozen by the court and will likely be liquidated to repay victims.

Cotten also ran fiat and cryptocurrency through three other exchanges, over time transferring 9,540 BTC, 387,783 ETH, and 239,020 Litecoin (LTC), worth a total of $226.2 million at current prices.

On one, he engaged in margin trading about 67,000 times in Dash (DASH), OmiseGO (OMG), Zcash (ZEC), and Doge (DOGE) cryptocurrencies, generating “substantial losses,” according to the report.

Kinsman is trying to trace the whereabouts of more than $60 million that was transferred out of another account with an unnamed offshore exchange. A third exchange in an unnamed location is working with Kinsman and local authorities to get approval to release information.

Then there were fees to the third-party payment processors (TPP) Cotten worked with as banks were unavailable. Nearly $9 million was paid to just two TPPs between 2017 and 2018, the report noted.

A big problem E&Y is having isn’t so much missing cold wallet passwords—those wallets were mostly empty and had last been used in April 2018— as it that Cotten’s record keeping was so sloppy. In fact, Kinsman noted, even Cotten didn’t keep track of QuadrigaCX’s funds himself very well, often resorting to asking third party payment processor’s (TPP) about the amount of funds they held for him.

“The Platform does not report and Quadriga does not track where these Funds, if they do exist, were to have been physically, or in the case of cryptocurrency, digitally maintained,” Kinsman told the court.

What this all means for users is fairly straightforward: most of the assets reportedly held for them by QuadrigaCX are gone, and they’re not coming back. Customers can file claims with the trustee by August 31, 2019 to get their share whatever funds are left. As the QuadrigaCX website has been down most of the year, creditors can access their account data via an account verification website set up by E&Y.

“The Monitor cautions that given the nature of the blockchain and cryptocurrency industry including the privacy and confidentiality features that attract investors to the industry the nature of the information available and the traceability of reserves and assets will be challenging,” Kinsman told the court. “However, the trustee’s efforts to seek to identify and recover available assets for ultimate distribution to the affected users is ongoing.”