“Even if these assets are stored in a cold wallet, once it is registered on the blockchain under the exchange’s name as it holds these tokens on behalf of its clients, in a liquidation scenario these assets still belong to the cryptocurrency-exchange,” said Greaves. Cold wallet is a cryptocurrency storage device that allows for the keeping of digital asset offline.

Some have argued that this provides additional safety to cryptocurrency asset owners compared to hot wallet, which is connected online and thus, more exposed to cybersecurity risks.

In fact, many cryptocurrency-exchanges require clients to deposit their cryptocurrency assets into the exchange’s wallets, hot or cold. Once this happens, there is a transfer of the cryptocurrency asset ownership via delivery, and the client would, at most, have a claim against the exchange only as an unsecured creditor, which ranks lower than those that are secured, said Gaven Cheong, a partner at law firm Simmons & Simmons.

“This is the difference between an unregulated market and the securities market, whereby assets and client monies are segregated from operational monies of the security exchange,” said Cheong.

A cryptocurrency-exchange operator that keeps most of its clients’ assets in cold wallet might be able to reduce the risk of being hacked, but not losses caused by human failure, or death.

When Canadian cryptocurrency-exchange Quadriga’s co-founder Gerald Cotten died last December, he brought C$190 million (US$142 million) in cryptocurrency assets into his grave, as he was the only person with the private key that could unlock the exchange’s cryptocurrency wallets. Credit protection proceedings are ongoing at the Nova Scotia Supreme Court, involving 115,000 users and C$250 million of assets, part of which is fiat currency.

The “key man risk” illustrated by Quadriga may also be the operational vulnerability that caused global cryptocurrency exchanges to lose over US$1.05 billion through thefts since the start of 2018.

In the case of Gatecoin, death or malicious intent by exchange insiders did not immediately trigger its insolvency. Its troubles started a few years back. The Hong Kong cryptocurrency-exchange had been losing clients since a hacking incident in 2016.

In early 2018, then head of marketing Thomas Glucksmann told South China Morning Post that about 40 per cent of clients were Hong Kong residents. At that point, after getting their bank accounts frozen by nine Hong Kong banks, some citing internal compliance reasons, Gatecoin switched to seek payment solutions in France, he said. The French payment service provider subsequently failed to return Gatecoin funds linked to a large volume of transfers.

Borrelli Walsh, the court-appointed liquidator that is now receiving creditors’ claims until the end of April, declined to comment.

In the case of Tokyo-based Mt. Gox, a hack in 2014 resulted in 800,000 bitcoin valued at US$500 million being stolen, which subsequently brought down the exchange and sent it into liquidation. That begged the question on whether there is a safe way for an exchange and investors to keep their private keys.

While exchanges have the responsibility in securing their clients’ digital assets, the other half of the responsibility of equal importance lies in designing an operational workflow and process that remove human access to the underlying private keys, said Henry Chong, chief executive of Fusang Investment Office, which launched its cryptocurrency-custody service called Fusang Vault in April.

“If an exchange claims that it is holding digital assets on the clients’ behalf, these should be segregated from the exchange’s balance sheet and be held by a third-party custodian,” Chong said. “If an official liquidator comes to us and give us a court order authorising us, as a custodian, to act for the aggrieved parties, we will verify that court order, and be prepared to execute on releasing the assets to the liquidator.”

In the same way that investors would demand checks and balances by fund managers and other financial intermediaries with a fiduciary duty to investors in conventional banking and finance, the same controls should be applied in the world of cryptocurrency trading, Chong said.

“A lot of exchanges act as though funds are held on behalf of their clients, but in reality they have not thought about the processes related to security and legal implications,” said Chong.

These involve building an operational process that requires multiple authorisations from both the exchange and Fusang Vault, for the clients’ cryptocurrency deposits to be moved, and limiting any individual from gaining direct access to private keys. Ultimately, the goal is to prevent clients’ cryptocurrency assets from being exposed to “a single point of failure”, he said.

Hong Kong’s Securities and Futures Commission (SFC) introduced a regulatory “sandbox” last November that invites participation by eligible operators of virtual asset trading platforms that are keen to be regulated by the city’s securities regulator.

The SFC is discussing with some of these operators to understand more about their operations, although the establishment of a regulatory regime for cryptocurrency exchange and trading is not a guaranteed outcome. The SFC declined to comment on specific insolvency cases, including Gatecoin.

Under its proposed regulations, the operators of cryptocurrency exchanges or trading platforms would need to limit their services to professional investors, defined as those with portfolios valued at a minimum of HK$8 million (US$1 million).

Exchanges may also be required to maintain a reserve equivalent to 12 months of operating expenses as financial buffer, and take out an insurance policy for risks associated with the custody of cryptocurrency assets, such as theft or hacking.

Custodian arrangement aside, are there other measures that cryptocurrency traders can take to better protect their assets?

“The best way is to withdraw coins or tokens from the centralised exchange into a personal wallet,” said Paul Li, general counsel for OAX Foundation, which is building a decentralised exchange poised for launch this year. “If you are trading on a centralised exchange, the cryptocurrency collateral is not truly yours, since it’s not locked in your personal wallet. You only own digital assets if you own your private keys.”

This is where a decentralised exchange could be useful. It enables traders to transact with each other from their own wallets, instead of having to deposit all their cryptocurrencies into the wallets of the exchange, thus avoiding the attention of hackers or cyber thieves.

For those that still use a centralised exchange, Cheong at Simmons & Simmons said clients can insist on a declaration of trust by the exchange on the cryptocurrency assets being deposited to ensure there is proper segregation of the trader’s cryptocurrency assets from the exchange’s other holdings.

“Whether any exchange will accommodate such a request is a different consideration and remains to be seen,” said Cheong.