What the case does—and does not—prove

The Ontario Securities Commission’s Quadriga review attributes the collapse to fraud by Gerald Cotten. It should not be presented as a case where all customer funds simply remained locked behind a deceased owner’s password.

The practical distinction is between recovery of a legitimate holding and verification that the holding exists. Independent accounting, separation of duties and accountable custody matter alongside backup and succession. A future message cannot repair missing assets or fraudulent records.

Apply the lesson without equating different risks

Personal self-custody is not the same arrangement as operating an exchange for customers. For personal assets, identify which recovery material and instructions are needed, where they are held and who is authorised to act. For a business, address governance and oversight as well as individual key loss.

Use a harmless rehearsal to identify missing knowledge. Avoid turning a fraud case into a sales claim that one online tool would have prevented the outcome. A useful plan documents which failure each control addresses and which risks remain.

Build a recoverable custody design

For personal holdings, document wallet types, chains, locations, passphrase use and a low-value recovery rehearsal. For customer or business assets, use separation of duties, multisignature or policy-controlled custody, independent accounting, access reviews and a formal incident process.

A ZeroLatch delivery can preserve selected instructions for one intended recipient after its supported check-in and safety-period sequence. It does not transfer assets, replace custody governance or prove incapacity. Never place the only usable key in one email, one device or one provider.

Questions for any key-person audit

Can another authorised person prove which wallets and balances belong to the organisation? Are signing keys separated from accounting records? Can a low-value transaction be completed without the founder? Are logs and approvals independently reviewed? Is there a process for replacing a signer?

If any answer depends on “the founder knows,” the control is incomplete. Fix daily governance first; use conditional delivery only as a documented long-horizon backstop.