In a plot line worthy of a Dan Brown novel, the 30 year old CEO and founder of QuadrigaCX, Gerald Cotton, was reported as having died in India at the end of last year, seemingly having taken the passwords to the company's cold storage wallets with him to his grave.
QuadrigaCX was reputed to be Canada's biggest cryptocurrency trading exchange and, at the time, was holding around 115,000 customers' cryptocurrency, with the total sum locked away estimated to be in the region of CAD250 (US$190) million.
Keeping cryptocurrency in a cold storage wallet is a widely used and appropriate method which seeks to ensure safety of cryptoassets which, when kept in hot storage, are vulnerable to attack and loss. A cold storage wallet is, in old school speak, an encrypted offline repository, which is in contrast to hot storage, where the cryptoassets are kept in a wallet connected to the internet (such as on your computer in a software wallet, or at an exchange). The advantage to cold storage is that, by not being connected to the internet, physical access is required to make transfers and, even if a person has physical access, the cold wallet is encrypted and therefore inaccessible without the entry of a valid password.
This was the problem for QuadrigaCX customers, as purportedly only Gerald Cotton had the passwords to the cold wallets. With his death, even if the wallets can be identified, the funds have apparently become inaccessible. Adding further mystery to the case, blockchain analytics firms have purportedly been unable to identify the cold wallets which should be holding the funds from the public blockchain (where a record of all transactions can be analysed), and therefore questions have arisen as to whether the purported funds existed at all.
Not many of us are in charge of a cryptocurrency exchange, perhaps, but increasing numbers of us may hold cryptocurrency in future. Many of us probably already hold digital assets. Succession planning for digital assets is another topic all of its own but, when it comes to cryptocurrency, what lessons can be learned from this spectacular, intriguing and slightly odd, but tragic case?
The first lesson in keeping cryptocurrency safe is to understand that the private key that you are given to your wallet is fundamental in allowing ongoing access to your cryptocurrency. Lose that and it really is the equivalent of locking up your currency and throwing away the key. Currently, there would be no way to recover the key or to seek redress in this situation. Yet this is a situation which can easily be played out on an individual’s death, if their legal personal representatives do not know where to find their private key to their online wallet.
The second lesson is to consider carefully the counterparties you utilise in connection with your cryptoasset holdings. Keeping funds in an exchange may be convenient, but exposes you to risk should the exchange be compromised or should (as in this case) its internal processes not be up to standard. Equally, self-custody in a cold wallet only reduces risk if you can ensure security of the device and the password, and appropriate safeguards are put in place to address future events.
Regardless of the medium of storage, where should an individual owning cryptocurrency keep either their private key or the password required to access the cold or hot wallet? A written note can be kept with their Will at the lawyers office or in a safe deposit at the bank, but that could be impractical to keep up to date as cryptoassets are transferred between wallets.
Perhaps some advantage of laying a trail for one’s PRs to find the key is that, whilst cyptoassets such as bitcoin are generally unregulated, there can be no suggestion of the individual having acted in breach of contract by facilitating access by others in situations informally agreed upon by those individuals.
As for QuadrigaCX, the plot continues to thicken. It has filed for bankruptcy, which the Nova Scotia Supreme Court has approved. QuadrigaCX’s court monitor, EY, is reportedly still unable to access the majority of its customers’ cryptocurrency. Meanwhile, the assets of the founder’s estate and most of the personal assets of the founder’s widow have reputedly been frozen following an asset protection order issued by the Canadian court.
