Nearly $1 million worth of ether (ETH) left QuadrigaCX and went to other cryptocurrency exchanges in December, the same month its CEO died, a CoinDesk review of public blockchain data shows.

In a series of transactions sent from QuadrigaCX’s hot wallet (meaning one connected to the internet), more than 9,000 ETH moved from the embattled Canadian exchange to accounts at Binance, Bitfinex, Kraken and Poloniex (owned by Circle).

The lion’s share – 5,000 ETH – was transferred from Dec. 2 to Dec. 8 – the day before the recorded death in India of QuadrigaCX founder and CEO Gerald Cotten. Most of the ether sent that week (4,550) ended up at Binance.

It is unclear whether it was the exchange itself that initiated these transactions, its customers, or some combination. But the flows of funds have come under scrutiny in the crypto community because of the company’s growing troubles.

Last week, QuadrigaCX went offline and subsequently filed for creditor protection in the Supreme Court of Nova Scotia, saying it owes customers $190 million but cannot find its late founder’s private keys to retrieve crypto held in cold storage.

That followed months of customer complaints about withdrawal delays, both for fiat and crypto. But looking at the ethereum blockchain, it is clear that someone was able to move significant amounts of QuadrigaCX as recently as December. (The company did not respond to a request for comment by press time.)

Besides ether, QuadrigaCX also held several other currencies on behalf of customers and users have been trying to identify its wallets on the bitcoin and litecoin blockchains. But ethereum is perhaps the easiest blockchain to follow the money in this case.

That’s because there is an obvious starting point: address 0x027BEEFcBaD782faF69FAD12DeE97Ed894c68549, labeled as QuadrigaCX’s on the block explorer site Etherscan. (It identifies wallets as belonging to specific companies when they request it, subject to verification.)

The trail starts in June 2017, the last time the publicly identified QuadrigaCX wallet was used. It was emptied into two other addresses.

One

of the two wallets received 3,000 ETH (around $825,000 at that time) on June 2, 2017. According to Taylor Monahan, founder and CEO of the wallet startup MyCrypto, this wallet is probably a certain user’s deposit account for another exchange, Bitfinex, since funds were regularly put into this wallet from QuadrigaCX addresses and then sent to Bitfinex.

“When you deposit to an exchange, you are given a unique address that is linked to your exchange account,” Monahan explained. “In most exchanges, you send funds to this account, it is automatically recorded in the exchange’s database, that amount shows up on the balances/dashboard of your exchange account, and the funds are moved from your ‘personal deposit address’ to the exchange’s ‘main’ or ‘hot’ wallet.”

The last transaction from this wallet was made on December 3 of last year, sending 1,099 ETH to Bitfinex.

The other wallet that received funds from the original QuadrigaCX address is identified as the exchange’s hot wallet in the court filings (0xB6AaC3b56FF818496B747EA57fCBe42A9aae6218).

Even before that, this address was widely believed to belong to the exchange. It was mentioned in a discussion about long withdrawal waits in a subreddit dedicated to the exchange and in Twitter thread about the problem.

And it is the source of the large transfers that took place in December 2018.

From Dec. 2-7, this wallet sent 4,550 ETH in several large transactions to another wallet which mostly interacted with QuadrigaCX’s addresses. During the same period, the latter wallet sent 4,550 ETH to a now-empty wallet, which most likely is a deposit address for Binance, based on the pattern of usage (funds come in, mostly from the QuadrigaCX-linked address, and then go out to Binance).

However, it’s hard to tell if the wallet sending ETH to the Binance deposit address was controlled by QuadrigaCX or belonged to a client who would send ETH from one exchange to the other. In several instances, funds were sent from this wallet to other addresses.

During the same time, through deposit addresses 177 ETH went to Bitfinex on December 6  and 386 ETH were sent to Kraken on December 8. Overall, during the entire month of December, more than 4,550 ETH were sent from QuadrigaCX to Binance, 2,400 ETH to Poloniex, 1,609 ETH to Bitfinex and 883 ETH to Kraken.

One possible explanation for the large December transfers is that QuadrigaCX sent the funds itself as it needed to convert crypto to fiat to fund its operations. The bank account of the exchange’s payment processor was frozen last year, blocking access to $22 million.

“Whether that is server bills or contractors, at some point you need cash,” said Monahan. “If you have a strained relationship with your banking partners, you may choose to obtain fiat via another mechanism. So it wouldn’t surprise me if an exchange used an [over-the-counter] desk or another exchange in the space in order to move ETH or BTC into fiat and ultimately pay bills.”

However, this explanation only goes so far. Binance and Poloniex weren’t dealing with fiat money at the time of these transactions (Binance launched a fiat-to-crypto exchange in January). So sending to those two exchanges would not have helped with raising operational cash.

As such, the reason for the transfers remains unclear, along with their originators. Binance, Kraken, Poloniex and Bitfinex didn’t respond by press time to CoinDesk’s questions about the deposit addresses listed above.

Another open question is the degree to which QuadrigaCX kept coins offline, in so-called cold storage, where the private key is not on any device connected to the internet.

In her affidavit filed with the Canadian court, Jennifer Robertson, identified as Cotten’s widow, wrote that the company kept “only a minimal amount of coins” in its hot wallet connected to the internet. In the normal course of business, Cotten “would move the majority of the coins to cold storage,” she wrote, adding that he held “sole responsibility for handling the funds and coins,” and the remaining team members have had no luck accessing the exchange’s cold wallets since.

Observers have been trying unsuccessfully to identify the cold wallets on the blockchain. Monahan said she suspects that the exchange had no cold wallet at all, at least for ether.

“Unless they enacted remarkably different practices in the last year, I would be very surprised to learn of a cold storage ether address based on what I’ve seen so far,” Monahan told CoinDesk. “Almost all of the largest transactions are either sent to exchanges or amongst three ‘primary’ addresses (1, 2, 3). I haven’t seen anything indicating a large reserve or cold storage mechanism being used on the Ethereum chain.”

All told, the analysis of QuadrigaCX’s ether wallets doesn’t look optimistic for the users who have their funds stuck on the exchange, with cryptos bleeding in the direction of other exchanges. 

Kraken CEO Jesse Powell commented on the situation in Twitter, writing that his company has “thousands of wallet addresses known to belong to QuadrigaCX” and the team is now investigating “the bizarre and, frankly, unbelievable story of the founder's death and lost keys.” He also offered assistance to Canadian police in case they are investigating the situation.

Additional reporting from Nik De.

Ether token image via Shutterstock