top of page

QuadrigaCX 2019: Collapse and $169 Million Shortfall

  • Writer: Matilda Drummond
    Matilda Drummond
  • Jun 15
  • 2 min read

Series: 2 Minute Case Studies

Root Cause Themes: Access Controls, Custodial Controls, Key Person Dependencies


Summary

In 2019, Canada’s largest cryptocurrency exchange, QuadrigaCX, collapsed and filed for creditor protection. The fallout left over 76,000 clients facing a staggering $169 million shortfall. While early reports blamed the crisis entirely on a lost password following the sudden passing of its CEO, the subsequent regulatory investigation by the Ontario Securities Commission revealed a systemic failure of internal oversight, corporate governance, and risk management.


Impact Breakdown

  • The Shortfall: Clients were collectively owed $215 million in assets at bankruptcy; the bankruptcy trustee (Ernst & Young) was only able to recover or identify $46 million.
  • Liquidity Freeze: Quadriga's behavior and reliance on third-party payment processors led to a liquidity freeze when the CIBC froze millions in connected accounts due to compliance red flags.

Root Causes & Vulnerabilities

  • Extreme Key Person Dependency: The CEO maintained sole control over corporate operations, financial books, and the private keys to cold storage wallets.
  • Ineffective Access Controls & Custodial Safeguards: Client funds were commingled and centralized without independent, third-party oversight or administrative accountability. This allowed a single individual to shift client assets onto external trading platforms without customer knowledge, consent, or internal dual-authorization protocols.
  • Regulatory Perception vs. Reality: The exchange operated during an era of minimal regulatory frameworks. An absence of regulation is often misconstrued as an indicator of low systemic risk; in reality, this lack of formal oversight actively facilitated unchecked internal fraud and a total absence of transparent financial reporting.

Sources


Enjoyed this breakdown? Follow for more case studies on how to identify hidden vulnerabilities and protect your organization. Let us know in the comments if there is a specific type of risk you want to know about!


Disclaimer: This is a high-level summary of a complex event with numerous compounding operational and legal variables.



Comments


bottom of page