Millions worth of Bitcoin inaccessible because of a lost password
Customers of the Canadian cryptocurrency exchange QuadrigaCX were left disgruntled and worried after the co-founder and CEO, Gerald Cotten, died last December.
You may be wondering why this is an important story for those of you who are in the business of estates. Well, let’s break it down.
The Situation
To understand what’s really going on here it’s important to have a little background information first.
The way QuadrigaCX operates is similar to having two different bank accounts when it comes to managing your virtual money: the one where you keep the majority of your money, and the one for smaller amounts that you use for various transactions.
For QuadrigaCX, the one with the majority of your cryptocurrency is called “cold storage,” and the one with the smaller amount is called a “hot wallet.”
For reference, here’s what that money is worth:
“The exchange holds roughly 26,500 bitcoin ($92.3 million USD), 11,000 bitcoin cash ($1.3 million), 11,000 bitcoin cash SV ($707,000), 35,000 bitcoin gold ($352,000), nearly 200,000 litecoin ($6.5 million) and about 430,000 ether ($46 million), totaling $147 million, according to the affidavit.” - CoinDesk
In January the company announced that Cotten suffered complications from Crohn’s disease and died while traveling in India, where he was apparently opening an orphanage for children in need.
That’s when things start to go wrong. QuadrigaCX users can’t access their cold storage currency, because Cotten handled those transactions himself manually.
Jennifer Robertson, Cotten’s widow and now estate trustee, said that he was “the sole officer and director” for the company, and had the “sole responsibility for handling the funds and coins.” That means he’s the only one who had access to the cold storage passcode, and he didn’t leave any indication of what it might be in his will.
Bottom line: Cotten was the only one who could access the cold storage money.
The Fallout
As it turns out, QuadrigaCX has now lost $190 million of its users money because Cotten took vital information to the grave.
The company filed for creditor protection in accordance with the Companies' Creditors Arrangement Act (CCAA) in the Nova Scotia Supreme Court at the end of January while they attempted to access the cold storage reserves. Apparently the security expert who was hired wasn’t able to break the encryption.
It’s not the first time QuadrigaCX has had issues with its funds - in January of last year CIBC froze $26 million of the company’s assets because of “irregularities” with payment processing:
“$67-million worth of transactions ended up improperly transferred into the personal account of Costodian Inc, the payment processor.” - Gizmodo.
To further complicate things, the circumstances of Cotten’s death have raised suspicion among a number of people online. People are claiming that Cotten isn’t actually dead, and that this is all part of an elaborate plan to take money from users:
“The people trying to pull off a QuadrigaCX exit scam could actually be the family and other employees, by hiding the fact that the cold wallet keys are known. Not saying this is happening, but need to consider all possibilities fairly in the investigation,” - Peter Todd, Bitcoin expert.
Robertson claims that Cotten ran the entire company on his encrypted laptop, and there are no company documents, records, or even a separate business bank account.
What makes this case interesting is that although Cotten didn’t leave any indication in his will of what the password may be, he did indeed take the time to update that will less than two weeks before his death.
Cotten appointed Robertson as his executor with instructions on what to do with his assets, such as property in BC and Nova Scotia, and his airplane. He is also one of the many in the growing trend of leaving an inheritance to pets by designating $100,000 for the care of his two dogs Nitro and Gully.
The question is why would Cotten take the time to detail the distribution of his money to his chihuahuas but completely ignore the keys to millions of dollars. His care and diligence in his will lends to the theory that perhaps the omittance of his QuadrigaCX passcode was on purpose; Cotten didn’t add it in because he didn’t plan on giving that money back.
The Problem with Digital Assets
Aside from the speculation around Cotten’s death, this situation raises a number of interesting questions about the law when it comes to Canada’s attitude toward digital assets.
There have been many cases in which someone who has passed away didn’t leave any passwords in their will for executors to access their digital property. If they can’t be accessed, they can’t be distributed, which in turn has left loved-ones in the lurch.
According to Dan Nelson, an estates lawyer from Civis Law, Canadian legislation still has work to do in terms of catching up in this area of law in order properly deal with these arising issues. Companies don’t have to provide executors access to a deceased’s online account because while it may be the user’s material, the right to set the rules of access fall to the company.
"It would be useful for legislation to clarify that … executors have authority to log into accounts and extract digital assets, including changing passwords." - Dan Nelson
The recommendation for now is to include information on where to find passwords in your will until the laws on digital property are updated.
Will QuadrigaCX customers ever see their money again? At this point, no one knows.